Remote Code Execution (RCE)

2020-12-0603:34:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.012 Low

EPSS

Percentile

85.2%

JSON

mathTeX is vulnerable to remote code execution. The vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag.

CPENameOperatorVersion
mathtex:sideq1.03-1+b2
mathtex:stretcheq1.03-1+b2
mathtex:bullseyeeq1.03-1+b2
mathtex:bustereq1.03-1+b2
mathtex:sideq1.03-1+b2
mathtex:stretcheq1.03-1+b2
mathtex:bullseyeeq1.03-1+b2
mathtex:bustereq1.03-1+b2

Name	Operator	Version
mathtex:sid	eq	1.03-1+b2
mathtex:stretch	eq	1.03-1+b2
mathtex:bullseye	eq	1.03-1+b2
mathtex:buster	eq	1.03-1+b2
mathtex:sid	eq	1.03-1+b2
mathtex:stretch	eq	1.03-1+b2
mathtex:bullseye	eq	1.03-1+b2
mathtex:buster	eq	1.03-1+b2