9.8

CVE-2016-10243

Exploit
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Fedoraproject ≫ Fedora Version25
Fedoraproject ≫ Fedora Version26
Tug ≫ Tex Live Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.15% 0.935
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.debian.org/security/2017/dsa-3803
Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/03/05/1
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/96593
Third Party Advisory
VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7CNJ4HKX7X6V7VMN3UCU7KPY6IX4XRB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL6PUKPWEXYIPIAZRIX5ZLQWCSALVLFP/
https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/
Third Party Advisory
Exploit
Technical Description
https://security.gentoo.org/glsa/201709-07
https://www.tug.org/svn/texlive?view=revision&revision=42605
Patch
Vendor Advisory