Debian Texlive-Bin vulnerabilities

CVE-2016-10243 [CRITICAL] CVE-2016-10243: texlive-base - TeX Live allows remote attackers to execute arbitrary commands by leveraging inc... TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file. Scope: local bookworm: resolved (fixed in 2016.20161130-1) bullseye: resolved (fixed in 2016.20161130-1) forky: resolved (fixed in 2016.20161130-1) sid: resolved (fixed in 2016.20161130-1) trixie: resolved (f

CVE-2014-9495 [HIGH] CVE-2014-9495: libpng1.6 - Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.... Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image. Scope: local bookworm: resolved (fixed in 1.6.16-1) bullseye: resolved (fixed in 1.6.16-1) forky: resolved (fixed in 1.6.1

CVE-2009-1284 [MEDIUM] CVE-2009-1284: texlive-bin - Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a den... Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a long .bib bibliography file. Scope: local bookworm: resolved (fixed in 2009-1) bullseye: resolved (fixed in 2009-1) forky: resolved (fixed in 2009-1) sid: resolved (fixed in 2009-1) trixie: resolved (fixed in 2009-1)

CVE-2015-0973 [HIGH] CVE-2015-0973: libpng1.6 - Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng befor... Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495. Scope: local bookworm: resolved (fixed in 1.6.16-1) bullseye: resolved (fixed in 1.6.16-1) forky: resolved (fixed

CVE-2019-18604 [CRITICAL] CVE-2019-18604: texlive-bin - In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in ... In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled. Scope: local bookworm: resolved (fixed in 2020.20200327.54578-2) bullseye: resolved (fixed in 2020.20200327.54578-2) forky: resolved (fixed in 2020.20200327.54578-2) sid: resolved (fixed in 2020.20200327.54578-2) trixie: resol

CVE-2018-17407 [HIGH] CVE-2018-17407: texlive-bin - An issue was discovered in t1_check_unusual_charstring functions in writet1.c fi... An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex. Scope: local bookworm: resolved (fixed in 2018.20180907.48586-2) bu

CVE-2023-32700 [HIGH] CVE-2023-32700: texlive-bin - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling... LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. Scope: local bookworm: resolved (fixed in 2022.20220321.62855-5.1) bullseye: resolved (fixe

CVE-2008-1693 [MEDIUM] CVE-2008-1693: poppler - The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before... The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this

CVE-2024-25262 [HIGH] CVE-2024-25262: texlive-bin - texlive-bin commit c515e was discovered to contain heap buffer overflow via the ... texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file. Scope: local bookworm: resolved (fixed in 2022.20220321.62855-5.1+deb12u2) bullseye: resolved (fixed in 2020.20200327.54578-7+deb11u2) forky: resolve

CVE-2009-3560 [MEDIUM] CVE-2009-3560: audacity - The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in ... The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-20

CVE-2009-3720 [MEDIUM] CVE-2009-3720: audacity - The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as ... The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625. Scope: local bookwor

CVE-2010-0739 [MEDIUM] CVE-2010-0739: texlive-bin - Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX... Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. Scope: local bookworm: resolved (fixed in 2009-6) bullsey

CVE-2010-0827 [MEDIUM] CVE-2010-0827: texlive-bin - Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote... Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file. Scope: local bookworm: resolved (fixed in 2009-6) bullseye: resolved (fixed in 2009-6) forky: resolved (fixed in 2009-6) sid

CVE-2007-5937 [MEDIUM] CVE-2007-5937: texlive-bin - Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and ea... Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file. Scope: local bookworm: resolved (fixed in 2007-13) bullseye: resolved (fixed in 2007-13) forky: resolved (fixed in 2007-13) sid: resolved (fixed in 2007-13) trixie: resolved (fixed in 20

CVE-2015-5700 [MEDIUM] CVE-2015-5700: texlive-bin - mktexlsr revision 22855 through revision 36625 as packaged in texlive allows loc... mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. Scope: local bookworm: resolved (fixed in 2014.20140926.35254-5) bullseye: resolved (fixed in 2014.20140926.35254-5) forky: resolved (fixed in 2014.20140926.35254-5) sid: resolved (fixed in 2014.20140926.35254-5) trixie: reso

CVE-2007-5935 [MEDIUM] CVE-2007-5935: texlive-bin - Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earl... Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag. Scope: local bookworm: resolved (fixed in 2007.dfsg.1-1) bullseye: resolved (fixed in 2007.dfsg.1-1) forky: resolved (fixed in 2007.dfsg.1-1) sid: resolved (fixed in 2007.dfsg.1-1) trixi

CVE-2010-1440 [MEDIUM] CVE-2010-1440: texlive-bin - Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and e... Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739. Scope: local

CVE-2023-32668 [MEDIUM] CVE-2023-32668: texlive-bin - LuaTeX before 1.17.0 allows a document (compiled with the default settings) to m... LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. Scope: local bookworm: resolved (fixed in 2022.20220321.62855-5.1+deb

CVE-2010-0829 [MEDIUM] CVE-2010-0829: dvipng - Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow r... Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed DVI file. Scope: local bookworm: resolved (fixed in 1.13-1) bullseye: resolved (fixed in 1.13-1) forky: resolved (fixed in 1.13-1) sid: resolved (fixed in 1.13-1) trixie: re

CVE-2021-27548 [MEDIUM] CVE-2021-27548: texlive-bin - There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() ... There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03. Scope: local bookworm: resolved (fixed in 2022.20220321.62855-3) bullseye: resolved forky: resolved (fixed in 2022.20220321.62855-3) sid: resolved (fixed in 2022.20220321.62855-3) trixie: resolved (fixed in 2022.20220321.62855-3)