Description
The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | a2ps | 1:4.13b-4.3 | — |
| Debian 13 | a2ps | 1:4.13b-4.3 | — |
| Debian 12 | a2ps | 1:4.13b-4.3 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | a2ps | 4.14-6.6 | openSUSE-SU-2024:10086-1 |
Advisories 1
- openSUSE-SU-2024:10086-1 a2ps-4.14-6.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-200501-02 vendor-advisory
- 12109 vdb-entry
- http://www.vuxml.org/freebsd/9168253c-5a6d-11d9-a9e7-0001020eed82.html
- 12108 vdb-entry
- gnu-a2ps-fixpsin-symlink(18671) vdb-entry
- gnu-a2ps-psmanupin-symlink(18672) vdb-entry
- 13641 third-party-advisory