CVE-2023-32700 | High | 7.8 | 2023-05-20 | LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core… |
CVE-2023-32668 | Medium | 5.5 | 2023-05-11 | LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket l… |
CVE-2018-17407 | High | 7.8 | 2018-09-23 | An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1… |
CVE-2017-17513 | High | 8.8 | 2017-12-14 | TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attack… |
CVE-2015-0296 | Medium | 4.7 | 2017-10-06 | The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to d… |
CVE-2015-5701 | Medium | 6.1 | 2017-08-25 | mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vuln… |
CVE-2015-5700 | Medium | 6.1 | 2017-08-25 | mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. |
CVE-2016-10243 | Critical | 9.8 | 2017-05-02 | TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file. |
CVE-2010-2642 | | | 2011-01-07 | Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products… |
CVE-2010-1440 | | | 2010-05-07 | Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (applica… |
CVE-2010-0829 | | | 2010-05-07 | Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly ex… |
CVE-2010-0827 | | | 2010-05-07 | Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute… |
CVE-2010-0739 | | | 2010-04-16 | Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbit… |
CVE-2007-5940 | | | 2007-11-13 | feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynm… |
CVE-2007-5937 | | | 2007-11-13 | Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a craft… |
CVE-2007-5936 | | | 2007-11-13 | dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files befo… |
CVE-2007-5935 | | | 2007-11-13 | Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file wit… |