PT-2017-6885 · Tex Live · Mktexlsr

Vasyl Kaigorodov · Publicado 2017-08-25 · Atualizado 2017-09-12 · CVE-2015-5701

Positive Technologies (AI Summary)

CVSS v2.0

5.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions mktexlsr versions as packaged in texlive before revision 36626 and after revision 36855

Description The issue allows local users to write to arbitrary files via a symlink attack. This problem exists due to the reversion of a previous fix.

Recommendations For versions as packaged in texlive before revision 36626 and after revision 36855, update to a version that includes the fix for this issue to prevent local users from writing to arbitrary files via a symlink attack.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2015-5701

Produtos afetados

Mktexlsr

Referências · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=1181167 · Correção
• https://tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?view=log · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/07/30/6 · Nota
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775139 · Nota
• https://tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?r1=19613&r2=22885 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5701 · Nota de Segurança