FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2015-8557

This CVE name corresponds to:

Entered	Topic
2016-01-09	pygments -- shell injection vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2015-8557 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2015-8557
Phase	Assigned(20151214)

Description

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

References

Source	Reference
FULLDISC	20151001 Shell Injection in Pygments FontManager._get_nix_font_path
MLIST	[oss-security] 20151214 CVE request: Shell Injection in Pygments FontManager._get_nix_font_path
MLIST	[oss-security] 20151214 Re: CVE request: Shell Injection in Pygments FontManager._get_nix_font_path
MISC	http://packetstormsecurity.com/files/133823/Pygments-FontManager._get_nix_font_path-Shell-Injection.html
MISC	https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff
UBUNTU	USN-2862-1