Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.

The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

Jakub Wilk found that a2ps, a tool to convert text and other types of files to PostScript, insecurely used a temporary file in spyuser(). A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running a2ps.

The original report in the Debian bug tracking system (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737385) notes the issue is in src/main.c:

559 tempnameensure (job->tmpfilenames[0]); 560 spyname = job->tmpfilenames[0]; 561 spy = fopen (spyname, "w");

And also notes there are other calls to tempnameensure().