Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

pstotext: insecure file name quoting

Package(s):

pstotext

CVE #(s):

CVE-2006-5869

Created:

November 27, 2006

Updated:

November 29, 2006

Description:

Brian May discovered that pstotext, a utility to extract plain text from Postscript and PDF files, performs insufficient quoting of file names, which allows execution of arbitrary shell commands.

Alerts:

Debian

DSA-1220-1

2006-11-26

(Log in to post comments)