Dan Rosenberg found a buffer overflow flaw in the way TeX text formatting system processed virtual font files. If a user was tricked into processing a specially-crafted typesetter-independent .dvi (DeVice Independent) file, it could lead to dvips executable crash or, potentially, to arbitrary code execution with the privileges of the user running dvips.

Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

An integer overflow was found in the way TeX text formatting system processed special commands. If a user was tricked into processing a specially-crafted typesetter-independent .dvi (DeVice Independent) file, it could lead to dvips executable crash or, potentially, to arbitrary code execution with the privileges of the user running dvips. Different vulnerability than CVE-2010-0739.

Dan Rosenberg reported multiple instances of an array index error in the way TeX text formatting system translated typesetter-independent .dvi (DeVice Independent) files into their Portable Network Graphics (PNG) alternatives. If a user was tricked into translation of a specially-crafted DVI file(s) into its PNG equivalent(s), it could lead to dvipng executable crash.

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

A heap based buffer overflow was found in the parser for AFM font files, which are used for rendering DVI files in GNOME evince document viewer. Due to insufficient bounds checks when writing data to a memory buffer allocated on a heap, it may be possible to cause an arbitrary memory overwrite, leading to code execution.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2642 to this issue.

The vulnerability is present in the code that handles loading of fonts used by DVI files.To exploit you need two files, a DVI file and the malicious font. The vulnerability is triggered not only by opening the document in evince, but also by browsing to a folder which contains the malicious files, where evince thumbnailer will load the malicious file to generate a thumbnail for it.

Acknowledgements:

Red Hat would like to thank the Evince development team for reporting this issue. Upstream acknowledges Jon Larimer of IBM X-Force as the original reporter.

It was reported [1] that mktexlsr script uses /tmp in an insecure way. Part of original report: ... This is how mktexlsr uses temporary files (with boring parts snipped):

treefile="${TMPDIR-/tmp}/mktexlsrtrees$$.tmp" ... while test $# -gt 0; do # ... (umask 077 if echo "$1" >>"$treefile"; then :; else echo "$progname: $treefile: could not append to arg file, goodbye." >&2 exit 1 fi # ... done

This is insecure because the filename is predictable and, more importantly, the program doesn't fail atomically if the file already exists. ...

Suggested patch is attached.

[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775139

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

An issue was discovered in t1checkunusualcharstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.

Description of problem:

dviljk contains multiple buffer overflow conditions that can be triggered by a DVI input file. This could possibly result in arbitrary code execution in case user was tricked into print a specially crafted DVI file.

Additional info:

See URL filed for Gentoo report. The attachment #249481 [details] fixes this bug together with bug #368611 It will most likely need some mungling as whitespace changes make the fixes less obvious.

Description of problem:

Dvips uses insecure tmpnam() function to create files for temporary data while converting a DVI file to laser jet printer format. A local attacker could conduct a time-dependent attack by creating the files before dviljk uses them which could possibly lead into information leak and would permit the attacker to modify the processed data.

Additional info:

See URL filed for Gentoo report. The attached file fixes this problem by using a secure temporary directory together with other issues.

feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.

Description of problem:

DVI file that contains a hypertex reference with long title can trigger a stack based buffer overflow of a statically sized char array when dvips is called with -z argument. This could possibly result in arbitrary code execution in case user was tricked into open a specially crafted DVI file.

Additional info:

This issue affects the versions of the tetex package, as shipped with Red Hat Enterprise Linux 3 and 4.

This issue has no security impact on tetex package version, as shipped in Red Hat Enterprise Linux 5 due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.

This issue has no security impact on texlive package versions, as shipped with Fedora releases of 11 and 12, due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.

See URL field for the orginal bug report from Debian project.

mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vulnerability exists due to the reversion of a fix of CVE-2015-5700.

A flaw was found in the pre-install script of texlive-base package derived from texlive package. This flaw allows unprivileged user to remove arbitrary files on the system.

~ rpm -qa texlive-base --scripts preinstall scriptlet (using /bin/sh): rm -rf /usr/share/texlive/texmf-var rm -rf /var/lib/texmf/

Following script in the preinstall scriplet allows attacker to remove arbitrary files on the systems for i in find /home//.texlive -type d -prune; do find $i -name .fmt -type f | xargs rm -f > /dev/null 2>&1 done ...

Attacker can create a malicious file in his $HOME directory that would trigger file removal and wait for the texlive-base package to be updated by administrator, as when package will be updated it would run preinstall scriplet which would then run malicious file in attacker $HOME directory as privileged user.

Reproducer and more information:

https://bugzilla.redhat.com/showbug.cgi?id=1099238

TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config file.

TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linkedscripts/context/stubs/unix/mtxrun, texmf-dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua.