Description
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | texlive-bin | 2014.20140926.35254-5 | — |
| Debian 13 | texlive-bin | 2014.20140926.35254-5 | — |
| Debian 12 | texlive-bin | 2014.20140926.35254-5 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | texlive-bin | 2017.20170613.44572-8ubuntu0.1 | USN-3788-1 |
| Ubuntu 16.04 LTS | texlive-bin | 2015.20160222.37495-1ubuntu0.1 | USN-3788-1 |
| Ubuntu 14.04 LTS | texlive-bin | 2013.20130729.30972-2ubuntu0.1 | USN-3788-1 |
Advisories 1
- USN-3788-1 texlive-bin vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
References
- [oss-security] 20150730 Re: CVE request: mktexlsr/texlive: insecure use of /tmp mailing-list
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775139
- https://www.tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?view=log
- https://www.tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?r1=19613&r2=22885
- https://bugzilla.redhat.com/show_bug.cgi?id=1181167
- USN-3788-1 vendor-advisory