Mageia alert MGASA-2014-0161 (a2ps)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2014-0161: Updated a2ps packages fix CVE-2014-0466 
Date:
    	     
 
Fri, 4 Apr 2014 12:58:34 +0200
Message-ID:
    	     
 
<20140404105834.4CF8341A0E@valstar.mageia.org>
MGASA-2014-0161 - Updated a2ps packages fix CVE-2014-0466

Publication date: 04 Apr 2014
URL: http://advisories.mageia.org/MGASA-2014-0161.html
Type: security
Affected Mageia releases: 3, 4
CVE: CVE-2014-0466

Description:
Updated a2ps packages fix security vulnerability:

Brian M. Carlson reported that a2ps's fixps script does not invoke gs with
the -dSAFER option. Consequently executing fixps on a malicious PostScript
file could result in files being deleted or arbitrary commands being
executed with the privileges of the user running fixps (CVE-2014-0466).

References:
- https://www.debian.org/security/2014/dsa-2892
- https://bugs.mageia.org/show_bug.cgi?id=13130
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0466

SRPMS:
- 4/core/a2ps-4.14-13.1.mga4
- 3/core/a2ps-4.14-12.2.mga3