Description
Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | latex2rtf | 2.3.10-1 | — |
| Debian 13 | latex2rtf | 2.3.10-1 | — |
| Debian 12 | latex2rtf | 2.3.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | latex2rtf | No fix yet | — |
References
- [oss-security] 20151116 CVE-2015-8106 - latex2rtf v2.3.8 format string vulnerability mailing-list
- FEDORA-2016-3e320f369e vendor-advisory
- https://sourceforge.net/p/latex2rtf/code/1244/
- FEDORA-2016-246417376c vendor-advisory
- FEDORA-2016-b9368247d4 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1282492