The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

According to the versions of the python-pygments package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows     remote attackers to execute arbitrary commands via shell metacharacters in a font name. (CVE-2015-8557)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-05 (Pygments: Arbitrary code execution)

    A vulnerability in FontManager&rsquo;s _get_nix_font_path function allows       shell metacharacters to be passed in a font name.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

Javantea discovered that pygments, a generic syntax highlighter, is prone to a shell injection vulnerability allowing a remote attacker to execute arbitrary code via shell metacharacters in a font name.

NVD reports :

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

It was discovered that Pygments incorrectly sanitized strings used to search system fonts. An attacker could possibly use this issue to execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a shell injection vulnerability in pygments, a syntax highlighting package written in Python.

For Debian 6 Squeeze, this issue has been fixed in pygments version 1.3.1+dfsg-1+deb6u11.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options.

ID	Name	Product	Family	Severity
190249	EulerOS 2.0 SP5 : python-pygments (EulerOS-SA-2024-1162)	Nessus	Huawei Local Security Checks	critical
158286	EulerOS 2.0 SP3 : python-pygments (EulerOS-SA-2022-1185)	Nessus	Huawei Local Security Checks	critical
95520	GLSA-201612-05 : Pygments: Arbitrary code execution	Nessus	Gentoo Local Security Checks	critical
87901	Debian DSA-3445-1 : pygments - security update	Nessus	Debian Local Security Checks	critical
87830	FreeBSD : pygments -- shell injection vulnerability (5f276780-b6ce-11e5-9731-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	critical
87814	Ubuntu 14.04 LTS : Pygments vulnerability (USN-2862-1)	Nessus	Ubuntu Local Security Checks	critical
87382	Debian DLA-369-1 : pygments security update	Nessus	Debian Local Security Checks	critical
87379	Amazon Linux AMI : python-pygments (ALAS-2015-630)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2015-8557

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical