PT-2017-6884
CVE-2015-5700
·
Published
2017-08-25
·
Updated
2018-10-12
Description by
CVSS 3.1
6.1
MediumMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions
mktexlsr versions 22855 through 36625
Description
The issue allows local users to write to arbitrary files via a symlink attack.
Recommendations
For versions 22855 through 36625, consider restricting access to the mktexlsr utility until a patch is available. As a temporary workaround, avoid using mktexlsr with untrusted input to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾