GNU TeXmacs: Privilege escalation

Background

GNU TeXmacs is a free WYSIWYG editing platform with special features for scientists.

Description

The texmacs and tm_mupad_help scripts in TeXmacs place a zero-length directory name in the LD_LIBRARY_PATH, which might result in the current working directory (.) to be included when searching for dynamically linked libraries.

Impact

A local attacker could gain escalated privileges via a specially crafted shared library.

Workaround

There is no known workaround at this time.

Resolution

All GNU TeXmacs users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-office/texmacs-1.0.7.2-r1"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since April 02, 2011. It is likely that your system is already no longer affected by this issue.