An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options.

According to the versions of the python-pygments package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows     remote attackers to execute arbitrary commands via shell metacharacters in a font name. (CVE-2015-8557)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a shell injection vulnerability in pygments, a syntax highlighting package written in Python.

For Debian 6 Squeeze, this issue has been fixed in pygments version 1.3.1+dfsg-1+deb6u11.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Javantea discovered that pygments, a generic syntax highlighter, is prone to a shell injection vulnerability allowing a remote attacker to execute arbitrary code via shell metacharacters in a font name.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-pygments: Shell injection in FontManager._get_nix_font_path (CVE-2015-8557)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-pygments: Shell injection in FontManager._get_nix_font_path (CVE-2015-8557)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

NVD reports :

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2862-1 advisory.

    It was discovered that Pygments incorrectly sanitized strings used to search system fonts. An attacker     could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201612-05 (Pygments: Arbitrary code execution)

    A vulnerability in FontManager&rsquo;s _get_nix_font_path function allows       shell metacharacters to be passed in a font name.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
87379	Amazon Linux AMI : python-pygments (ALAS-2015-630)	Nessus	Amazon Linux Local Security Checks	12/16/2015	9/4/2018	critical
158286	EulerOS 2.0 SP3 : python-pygments (EulerOS-SA-2022-1185)	Nessus	Huawei Local Security Checks	2/23/2022	2/23/2022	critical
87382	Debian DLA-369-1 : pygments security update	Nessus	Debian Local Security Checks	12/16/2015	1/11/2021	critical
87901	Debian DSA-3445-1 : pygments - security update	Nessus	Debian Local Security Checks	1/14/2016	1/11/2021	critical
199260	RHEL 6 : python-pygments (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
199270	RHEL 7 : python-pygments (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
87830	FreeBSD : pygments -- shell injection vulnerability (5f276780-b6ce-11e5-9731-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	1/11/2016	1/4/2021	critical
190249	EulerOS 2.0 SP5 : python-pygments (EulerOS-SA-2024-1162)	Nessus	Huawei Local Security Checks	2/8/2024	2/8/2024	critical
87814	Ubuntu 14.04 LTS : Pygments vulnerability (USN-2862-1)	Nessus	Ubuntu Local Security Checks	1/8/2016	8/27/2024	critical
95520	GLSA-201612-05 : Pygments: Arbitrary code execution	Nessus	Gentoo Local Security Checks	12/5/2016	1/11/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical