616 matches found
CVE-2017-17513: Improper Neutralization of Special Elements in Output Used by a Downstream Component
TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linkedscripts/context/stubs/unix/mtxrun,...
PT-2017-14824
Name of the Vulnerable Software and Affected Versions TeX Live versions through 20170524 Description The issue is related to the lack of validation of strings before launching the program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injectio...
[SECURITY] Fedora 27 Update: transfig-3.2.6a-1.fc27
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...
[SECURITY] Fedora 26 Update: transfig-3.2.6a-1.fc26
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...
GLSA-201709-07 : Kpathsea: User-assisted execution of arbitrary code
The remote host is affected by the vulnerability described in GLSA-201709-07 Kpathsea: User-assisted execution of arbitrary code It was discovered that the mpost program from the shellescapecommands list is capable of executing arbitrary external programs during the conversion of .tex files. The...
Kpathsea: User-assisted execution of arbitrary code
Background Kpathsea is a library to do path searching. It is used by TeX Live and others TeX related software. Description It was discovered that the mpost program from the shellescapecommands list is capable of executing arbitrary external programs during the conversion of .tex files. The...
Unspecified vulnerability in mktexlsr (CNVD-2017-30561)
mktexlsr is a library for generating catalogs. A security vulnerability exists in mktexlsr revision 36855 and versions prior to revision 36626. A local attacker can overwrite arbitrary files with the help of symbolic links...
Ubuntu 14.04 LTS / 16.04 LTS : TeX Live vulnerability (USN-3401-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3401-1 advisory. It was discovered that TeX Live incorrectly handled certain system commands. If a user were tricked into processing a specially crafted TeX file, a...
USN-3401-1: TeX Live vulnerability
It was discovered that TeX Live incorrectly handled certain system commands. If a user were tricked into processing a specially crafted TeX file, a remote attacker could execute arbitrary code...
USN-3401-1 texlive-base vulnerability
It was discovered that TeX Live incorrectly handled certain system commands. If a user were tricked into processing a specially crafted TeX file, a remote attacker could execute arbitrary code...
MGASA-2017-0127 Updated texlive packages fix security vulnerability
It was discovered that texlive whitelists mpost as an external program to be run from within the TeX source code called \write18. Since mpost allows to specify other programs to be run, an attacker can take advantage of this flaw for arbitrary code execution when compiling a TeX document...
DEBIAN-CVE-2016-10243
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config file...
Design/Logic Flaw
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config file...
CVE-2016-10243
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config file...
CVE-2016-10243
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config file...
CVE-2016-10243
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config file...
CVE-2016-10243
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config file...
CVE-2016-10243
CVE-2016-10243 affects TeX Live: the mpost component can be invoked via shell_escape_commands in texmf.cnf, enabling remote command execution. The vulnerability arises from including mpost in shell_escape_commands, allowing a remote attacker to run arbitrary commands when TeX Live processes craft...
