The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function
    and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a
    temporary file. (CVE-2001-1593)

  - The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-
    dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
    (CVE-2014-0466)

Several vulnerabilities have been found in a2ps, an 'Anything to PostScript' converter and pretty-printer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2001-1593     The spy_user function which is called when a2ps is     invoked with the --debug flag insecurely used temporary     files.

  - CVE-2014-0466     Brian M. Carlson reported that a2ps's fixps script does     not invoke gs with the -dSAFER option. Consequently     executing fixps on a malicious PostScript file could     result in files being deleted or arbitrary commands     being executed with the privileges of the user running     fixps.

ID	Name	Product	Family	Severity
401086	Alpine: multiple a2ps packages: security update to 4.14-r4 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401086	Alpine: multiple a2ps packages: security update to 4.14-r4 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
73278	Debian DSA-2892-1 : a2ps - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2001-1593

medium

Tenable Plugins

critical

critical

medium