CVE-2002-0836 dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving...
HighCVSS 7.5
EPSS 8.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HP Inc secure os | = 1.0 | No fix listed |
| mandrakesoft mandrake linux | = 7.2 | No fix listed |
| mandrakesoft mandrake linux | = 8.0 | No fix listed |
| mandrakesoft mandrake linux | = 8.1 | No fix listed |
| mandrakesoft mandrake linux | = 8.2 | No fix listed |
| mandrakesoft mandrake linux | = 9.0 | No fix listed |
| redhat linux | = 6.2 | No fix listed |
| redhat linux | = 7.0 | No fix listed |
| redhat linux | = 7.1 | No fix listed |
| redhat linux | = 7.2 | No fix listed |
| redhat linux | = 7.3 | No fix listed |
| redhat linux | = 8.0 | No fix listed |
References
- CLA-2002:537 vendor-advisory
- 20021018 GLSA: tetex mailing-list
- 20021216 [OpenPKG-SA-2002.015] OpenPKG Security Advisory (tetex) mailing-list
- DSA-207 patch vendor-advisory
- dvips-system-execute-commands(10365) vdb-entry vendor-advisory
- VU#169841 third-party-advisory us-government-resource
- MDKSA-2002:070 vendor-advisory
- RHSA-2002:194 patch vendor-advisory
- RHSA-2002:195 vendor-advisory
- HPSBTL0210-073 vendor-advisory
- 5978 patch vdb-entry vendor-advisory