PT-2012-1276 · Html2Ps · Html2Ps

Vincent Danen · Published 2012-10-10 · Updated 2023-02-13 · CVE-2009-5067

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions html2ps versions prior to 1.0b6

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the include file SSI directive. This might be a problem in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service.

Recommendations For versions prior to 1.0b6, update to version 1.0b6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the include file SSI directive to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-5067

Affected Products

Html2Ps

References · 13

• 🔥 http://packetstormsecurity.org/files/81614/html2ps-1.0-beta5-File-Disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/10012 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-5067 · Security Note
• https://osv.dev/vulnerability/CVE-2009-5067 · Vendor Advisory
• http://user.it.uu.se/~jan/html2ps-1.0b7.tar.gz · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-5067 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:161 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-5067 · Vendor Advisory
• http://securityfocus.com/bid/36524 · Note
• http://openwall.com/lists/oss-security/2012/10/05/1 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=526513 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=548633 · Note
• http://openwall.com/lists/oss-security/2012/10/05/5 · Note