a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.

Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.

The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

Jakub Wilk found that a2ps, a tool to convert text and other types of files to PostScript, insecurely used a temporary file in spyuser(). A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running a2ps.

The original report in the Debian bug tracking system (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737385) notes the issue is in src/main.c:

559 tempnameensure (job->tmpfilenames[0]); 560 spyname = job->tmpfilenames[0]; 561 spy = fopen (spyname, "w");

And also notes there are other calls to tempnameensure().

The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.