TU
Vendor
Tug
20
CVEs
0
On KEV
0
New 30D
Products
TL9.8
Tex Live
Tug
8 CVEs0 on KEV0 new
TE–
Tetex
Tug
5 CVEs0 on KEV0 new
T2–
Texlive 2007
Tug
4 CVEs0 on KEV0 new
TE6.1
Texlive
Tug
3 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-32700 | TL Tex Live Tug | 7.8 | May 20 | LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source |
| CVE-2023-32668 | TL Tex Live Tug | 5.5 | May 11 | LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests |
| CVE-2018-17407 | TL Tex Live Tug | 7.8 | Sep 23 | An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21 |
| CVE-2017-17513 | TL Tex Live Tug | 8.8 | Dec 14 | TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct… |
| CVE-2015-0296 | TE Texlive Tug | 4.7 | Oct 6 | The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to delete arbitrary… |
| CVE-2015-5701 | TE Texlive Tug | 6.1 | Aug 25 | mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack |
| CVE-2015-5700 | TE Texlive Tug | 6.1 | Aug 25 | mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack |
| CVE-2016-10243 | TL Tex Live Tug | 9.8 | May 2 | TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file |
| CVE-2010-2642 | TE Tetex Tug | – | Jan 7 | Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote… |
| CVE-2010-1440 | TL Tex Live Tug | – | May 7 | Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or… |
| CVE-2010-0829 | TE Tetex Tug | – | May 7 | Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code… |
| CVE-2010-0827 | TL Tex Live Tug | – | May 7 | Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via… |
| CVE-2010-0739 | TE Tetex Tug | – | Apr 16 | Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a… |
| CVE-2007-5940 | T2 Texlive 2007 Tug | – | Nov 13 | feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary… |
| CVE-2007-5936 | T2 Texlive 2007 Tug | – | Nov 13 | dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are… |
| CVE-2007-5937 | T2 Texlive 2007 Tug | – | Nov 13 | Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file |
| CVE-2007-5935 | T2 Texlive 2007 Tug | – | Nov 13 | Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag |