CVE-2015-8557
Fixed in a distro release EPSS 7%
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Products: canonical ubuntu_linux, pygments
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pygments | 2.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pygments | 2.0.1+dfsg-2 |
| Debian 13 | pygments | 2.0.1+dfsg-2 |
| Debian 14 | pygments | 2.0.1+dfsg-2 |
| Debian 6.0 | pygments | 1.3.1+dfsg-1+deb6u11 |
| Debian 7 | pygments | 1.5+dfsg-1+deb7u1 |
| Debian 8 | pygments | 2.0.1+dfsg-1.1+deb8u1 |
| Ubuntu 14.04 LTS | pygments | 1.6+dfsg-1ubuntu1.1 |