CVE-2019-17626

Debian Bug report logs - #942763 python-reportlab: CVE-2019-17626: remote code execution in colorspy Package: src:python-reportlab; Maintainer for src:python-reportlab is Matthias Klose <doko@debianorg>; Reported by: Hugo Lefeuvre <hle@debianorg> Date: Mon, 21 Oct 2019 08:30:02 UTC Severity: important Tags: securi ...

ReportLab could be made to run programs as your login if it opened a specially crafted file ...

Synopsis Important: python-reportlab security update Type/Severity Security Advisory: Important Topic An update for python-reportlab is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A ...

Synopsis Important: python-reportlab security update Type/Severity Security Advisory: Important Topic An update for python-reportlab is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System ...

Synopsis Important: python-reportlab security update Type/Severity Security Advisory: Important Topic An update for python-reportlab is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System ...

Synopsis Important: python-reportlab security update Type/Severity Security Advisory: Important Topic An update for python-reportlab is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System ...

It was discovered that python-reportlab, a Python library to create PDF documents, is prone to a code injection vulnerability while parsing a color attribute An attacker can take advantage of this flaw to execute arbitrary code if a specially crafted document is processed For the oldstable distribution (stretch), this problem has been fixed in ve ...

ReportLab through 3526 allows remote code execution because of toColor(eval(arg)) in colorspy, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code (CVE-2019-17626) ...