CVE-2002-0836

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-10-28 · updated 2026-06-16

Description

dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.

Affected products

HP Secure Os: 1.0
Mandrakesoft Mandrake Linux: 7.2, 8.0, 8.1, 8.2, 9.0
RedHat Linux: 6.2, 7.0, 7.1, 7.2, 7.3, 8.0

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000537
http://marc.info/?l=bugtraq&m=103497852330838&w=2
http://marc.info/?l=bugtraq&m=104005975415582&w=2
http://www.debian.org/security/2002/dsa-207
http://www.iss.net/security_center/static/10365.php
http://www.kb.cert.org/vuls/id/169841
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-070.php
http://www.redhat.com/support/errata/RHSA-2002-194.html
http://www.redhat.com/support/errata/RHSA-2002-195.html
http://www.securityfocus.com/advisories/4567
http://www.securityfocus.com/bid/5978
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000537

Get alerted when CVE-2002-0836 or the next vulnerability affects your stack