MGASA-2015-0456
Updated python-pygments packages fix security vulnerability
An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options (rhbz#1276321).
What each source reports
OSV No score
Updated python-pygments packages fix security vulnerability
An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options (rhbz#1276321).
- Record
MGASA-2015-0456- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-pygmentsMageia:5 |
before 1.6-8.1.mga5 | 1.6-8.1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2015-0456 is a vulnerability with no CVSS score yet in python-pygments, published November 26, 2015. No source lists public exploit code. Fixed in python-pygments 1.6-8.1.mga5.