PT-2015-7941 · Unknown · Fontmanager

Published 2015-11-26 · Updated 2015-11-26

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions FontManager (affected versions not specified)

Description The issue arises from an unsafe use of string concatenation in a shell string within FontManager. This allows an attacker to execute any shell command on the remote system if they are permitted to choose the font and an image is outputted. The name variable, which is injected from the FontManager constructor invoked by ImageFormatter from options, is the source of the vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2015-0456

Affected Products

Fontmanager

References · 4

• https://osv.dev/vulnerability/MGASA-2015-0456 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2015-November/171882.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0456.html · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=17165 · Note