CVE-2015-8557

Debian Bug report logs - #802828 python-pygments: CVE-2015-8557: shell injection in FontManager_get_nix_font_path Package: python-pygments; Maintainer for python-pygments is Piotr Ożarowski <piotr@debianorg>; Source for python-pygments is src:pygments (PTS, buildd, popcon) Reported by: Jakub Wilk <jwilk@debianorg> ...

Pygments could be made to crash or run programs if it processed a specially crafted font request ...

Javantea discovered that pygments, a generic syntax highlighter, is prone to a shell injection vulnerability allowing a remote attacker to execute arbitrary code via shell metacharacters in a font name For the oldstable distribution (wheezy), this problem has been fixed in version 15+dfsg-1+deb7u1 For the stable distribution (jessie), this probl ...

An unsafe use of string concatenation in a shell string occurs in FontManager If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options ...

The FontManager_get_nix_font_path function in formatters/imgpy in Pygments 122 through 202 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name ...