ALT-PU-2015-2856

Критический

ALT-PU-2015-2856: package python-module-Pygments update to version 2.0.2-alt1

Источник

errata.altlinux.org

Дата публикации

20.01.2015

Дата обновления

20.01.2015

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades python-module-Pygments to version 2.0.2-alt1.

Устраненные уязвимости1

CVE-2015-8557

Критический 9

Дата публикации: 08.01.2016

CWE-78

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name. * GHSA-fff8-4w9p-7v76: Command Injection in Pygments

CVSS 3.0

Критический 9

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Критический 9.3

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access vector: Network
Complexity: Medium
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Ссылки

CVE-2015-8557 https://nvd.nist.gov/vuln/detail/CVE-2015-8557

Ссылки2

ALT-PU-2015-2856 https://errata.altlinux.org/ALT-PU-2015-2856

GHSA-fff8-4w9p-7v76

https://github.com/advisories/GHSA-fff8-4w9p-7v76

Связанные уязвимости

CVE-2015-8557

CVSS3: 9

ubuntu

почти 11 лет назад

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

CVE-2015-8557

redhat

около 11 лет назад

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

CVE-2015-8557

CVSS3: 9

nvd

почти 11 лет назад

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

CVE-2015-8557

CVSS3: 9

debian

почти 11 лет назад

The FontManager._get_nix_font_path function in formatters/img.py in Py ...

GHSA-fff8-4w9p-7v76

CVSS3: 9

github

больше 4 лет назад

Command Injection in Pygments