CVE-2014-0466

9 documents7 sources
Severity
6.8MEDIUM
EPSS
0.3%
top 43.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU A2ps
Timeline
PublishedApr 3
Latest updateMay 17

Description

The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶Debiana2ps< 1:4.14-1.3+3
▶NVDgnu/a2ps4.14

🔴Vulnerability Details

3
GHSA
GHSA-5wf6-vx35-ff8x: The fixps script in a2ps 4↗2022-05-17
▶
OSV
CVE-2014-0466: The fixps script in a2ps 4↗2014-04-03
▶
CVEList
CVE-2014-0466: The fixps script in a2ps 4↗2014-04-03
▶

📋Vendor Advisories

2
Red Hat
a2ps: fixps does not invoke gs with -dSAFER↗2014-03-28
▶
Debian
CVE-2014-0466: a2ps - The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs,...↗2014
▶

💬Community

3
Bugzilla
CVE-2014-0466 a2ps: fixps does not invoke gs with -dSAFER↗2014-03-31
▶
Bugzilla
CVE-2014-0466 a2ps: fixps does not invoke gs with -dSAFER [fedora-all]↗2014-03-31
▶
Bugzilla
CVE-2014-0466 a2ps: fixps does not invoke gs with -dSAFER [epel-6]↗2014-03-31
▶