The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| A2ps | Gnu | * | 4.14 (including) |
| A2ps | Gnu | 4.10.3 (including) | 4.10.3 (including) |
| A2ps | Gnu | 4.10.4 (including) | 4.10.4 (including) |
| A2ps | Gnu | 4.12 (including) | 4.12 (including) |
| A2ps | Gnu | 4.13 (including) | 4.13 (including) |
| A2ps | Gnu | 4.13b (including) | 4.13b (including) |
| A2ps | Ubuntu | lucid | * |
| A2ps | Ubuntu | precise | * |