MGASA-2015-0478

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2015-0478.html
Import Source
https://advisories.mageia.org/MGASA-2015-0478.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2015-0478
Upstream
Published
2015-12-17T20:19:23Z
Modified
2026-04-16T06:23:46.507185139Z
Summary
Updated python-pygments packages fix security vulnerability
Details

An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options (CVE-2015-8557, rhbz#1276321).

References
Credits

Affected packages

Mageia:5 / python-pygments

Package

Name
python-pygments
Purl
pkg:rpm/mageia/python-pygments?arch=source&distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.6-9.1.mga5

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2015-0478.json"