VulnerabilityModified
CVE-2002-0836
dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.
HIGH 7.5EPSS 7.95%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 7.95% probability · 94th percentile
- CISA KEV
- Not listed
- Affected
- hp/secure os · mandrakesoft/mandrake linux · redhat/linux
- Source
- cve@mitre.org
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000537
- http://marc.info/?l=bugtraq&m=103497852330838&w=2
- http://marc.info/?l=bugtraq&m=104005975415582&w=2
- http://www.debian.org/security/2002/dsa-207Patch, Vendor Advisory
- http://www.iss.net/security_center/static/10365.phpVendor Advisory
- http://www.kb.cert.org/vuls/id/169841US Government Resource
- http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-070.php
- http://www.redhat.com/support/errata/RHSA-2002-194.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2002-195.html
- http://www.securityfocus.com/advisories/4567
- http://www.securityfocus.com/bid/5978Patch, Vendor Advisory
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000537
- http://marc.info/?l=bugtraq&m=103497852330838&w=2
- http://marc.info/?l=bugtraq&m=104005975415582&w=2
- http://www.debian.org/security/2002/dsa-207Patch, Vendor Advisory
- http://www.iss.net/security_center/static/10365.phpVendor Advisory
- http://www.kb.cert.org/vuls/id/169841US Government Resource
- http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-070.php
- http://www.redhat.com/support/errata/RHSA-2002-194.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2002-195.html
- http://www.securityfocus.com/advisories/4567
- http://www.securityfocus.com/bid/5978Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.