pygments -- shell injection vulnerability

2015-09-2800:00:00

vuxml.freebsd.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.015

Percentile

86.8%

JSON

NVD reports:

The FontManager._get_nix_font_path function in formatters/img.py
in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute
arbitrary commands via shell metacharacters in a font name.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchpy27-pygments< 2.0.2_1UNKNOWN
FreeBSDanynoarchpy32-pygments< 2.0.2_1UNKNOWN
FreeBSDanynoarchpy33-pygments< 2.0.2_1UNKNOWN
FreeBSDanynoarchpy34-pygments< 2.0.2_1UNKNOWN
FreeBSDanynoarchpy35-pygments< 2.0.2_1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	py27-pygments	< 2.0.2_1	UNKNOWN
FreeBSD	any	noarch	py32-pygments	< 2.0.2_1	UNKNOWN
FreeBSD	any	noarch	py33-pygments	< 2.0.2_1	UNKNOWN
FreeBSD	any	noarch	py34-pygments	< 2.0.2_1	UNKNOWN
FreeBSD	any	noarch	py35-pygments	< 2.0.2_1	UNKNOWN