CVE-2015-0296

Name of the Vulnerable Software and Affected Versions texlive versions 3.1.20140525 r34255.fc21 and 6.20131226 r32488.fc20

Description The issue allows local users to delete arbitrary files via a crafted file in the user's home directory. This is due to a problem in the pre-install script in the affected texlive packages.

Recommendations For texlive version 3.1.20140525 r34255.fc21, update to a version that fixes the issue with the pre-install script. For texlive version 6.20131226 r32488.fc20, update to a version that fixes the issue with the pre-install script. As a temporary workaround, consider restricting write access to sensitive files in the user's home directory until a patch is available.