The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade a2ps. | Aug 30, 2017 | Apr 3, 2014 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 3, 2014 |
| Debian | — | Upgrade a2ps | Jul 30, 2024 | Apr 3, 2014 |
| Gentoo Linux | — | Upgrade app-text/a2ps. | Oct 30, 2017 | Apr 3, 2014 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Apr 3, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2014 |
| Suse | — | Upgrade a2psUpgrade a2ps-devel | Dec 18, 2015 | Apr 3, 2014 |
| Ubuntu | — | Upgrade a2ps | Nov 19, 2024 | Apr 3, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub