Remote code execution in GNU a2ps



| Updated: 2020-05-06
Risk High
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2015-8107
CWE-ID CWE-134
Exploitation vector Network
Public exploit N/A
Vulnerable software
 a2ps
Other software / Other software solutions

Vendor GNU

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Format string error

EUVDB-ID: #VU27577

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-8107

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a format string error in GNU a2ps. A remote attacker can supply a specially crafted input that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

a2ps: 4.14

CPE2.3 External links

https://seclists.org/oss-sec/2015/q4/284
https://www.securityfocus.com/bid/77595


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###