CVE-2014-0466: The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependen

This month

MEDIUM 6.8WATCHLISTDOWNGRADE

CVE-2014-0466 is a medium-severity flaw (CVSS 6.8) affecting a2ps. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

Why this priority

On your watchlist

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	6.8 (Medium)
EPSS exploit chance	2.4% (top 16%)
CISA exploited list	No
Published	2014-04-03
Last modified	2026-06-17

Publisher (CNA): Debian GNU/Linux · Vendor: gnu

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-04-03 16:15 UTCPublished CVE record published
2026-06-17 00:03 UTCUpdated Record last modified

gnu a2ps DOWNGRADE

Affected: 4.14

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.14

1. Check installed version

apt-cache policy a2ps || rpm -q a2ps || a2ps --version

2. No fixed release: DOWNGRADE to a release before 4.14 (Debian / Ubuntu)

apt-cache madison a2ps sudo apt install a2ps=<VERSION_BEFORE_4.14> sudo apt-mark hold a2ps

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list a2ps sudo dnf downgrade a2ps-<VERSION_BEFORE_4.14> sudo dnf versionlock add a2ps

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-0466?

a2ps: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2014-0466 being exploited?

CVE-2014-0466 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2014-0466 affect?

CVE-2014-0466 affects a2ps. Severity is medium (CVSS 6.8). The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

How urgent is CVE-2014-0466?

Priority 50/100. On your watchlist

Related CVEs

CVE-2015-8107 HIGH 7.8 DOWNGRADE Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
CVE-2004-1377 LOW 2.1 DOWNGRADE MITIGATE The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users
CVE-2004-1170 HIGH 10.0 DOWNGRADE DOWNGRADE a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.
CVE-2001-1593 LOW 2.1 UPGRADE The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and

References

← Back to latest CVEs