PT-2017-6885 · Tex Live · Mktexlsr

Vasyl Kaigorodov · Published 2017-08-25 · Updated 2017-09-12 · CVE-2015-5701

Positive Technologies (AI Summary)

CVSS v2.0

5.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions mktexlsr versions as packaged in texlive before revision 36626 and after revision 36855

Description The issue allows local users to write to arbitrary files via a symlink attack. This problem exists due to the reversion of a previous fix.

Recommendations For versions as packaged in texlive before revision 36626 and after revision 36855, update to a version that includes the fix for this issue to prevent local users from writing to arbitrary files via a symlink attack.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2015-5701

Affected Products

Mktexlsr

References · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=1181167 · Patch
• https://tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?view=log · Vendor Advisory
• https://tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?r1=19613&r2=22885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5701 · Security Note
• http://openwall.com/lists/oss-security/2015/07/30/6 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775139 · Note