CVE-2009-5067

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 7.6%

from disclosure to weapon0 days

Published on NVDOct 10

1st PoCSep 25

exploitation probability

7.6%top 6% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/10012 cve_referencepacketstormsecurity.org/files/81614/html2ps-1.0-beta5-File-Disclosure.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=548633 http://packetstormsecurity.org/files/81614/html2ps-1.0-beta5-File-Disclosure.html https://bugzilla.redhat.com/show_bug.cgi?id=526513 http://user.it.uu.se/~jan/html2ps-1.0b7.tar.gz http://www.mandriva.com/security/advisories?name=MDVSA-2012:161 http://www.openwall.com/lists/oss-security/2012/10/05/1 http://www.openwall.com/lists/oss-security/2012/10/05/5 http://www.securityfocus.com/bid/36524