PT-2015-7941 · Unknown · Fontmanager

Publicado 2015-11-26 · Atualizado 2015-11-26

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions FontManager (affected versions not specified)

Description The issue arises from an unsafe use of string concatenation in a shell string within FontManager. This allows an attacker to execute any shell command on the remote system if they are permitted to choose the font and an image is outputted. The name variable, which is injected from the FontManager constructor invoked by ImageFormatter from options, is the source of the vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

MGASA-2015-0456

Produtos afetados

Fontmanager

Referências · 4

• https://osv.dev/vulnerability/MGASA-2015-0456 · Aviso do Fabricante
• https://lists.fedoraproject.org/pipermail/package-announce/2015-November/171882.html · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=17165 · Nota
• https://advisories.mageia.org/MGASA-2015-0456.html · Nota de Segurança