Description
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | texlive-base | 2016.20161130-1 | — |
| Debian 14 | texlive-bin | 2019.20190605.51237-2 | — |
| Debian 13 | texlive-base | 2016.20161130-1 | — |
| Debian 13 | texlive-bin | 2019.20190605.51237-2 | — |
| Debian 12 | texlive-base | 2016.20161130-1 | — |
| Debian 12 | texlive-bin | 2019.20190605.51237-2 | — |
| Debian 8 | texlive-base | 2014.20141024-2+deb8u1 | DSA-3803-1 |
| Debian 7 | texlive-base | 2012.20120611-5+deb7u1 | DLA-847-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | texlive-base | 2015.20160320-1ubuntu0.1 | USN-3401-1 |
| Ubuntu 14.04 LTS | texlive-base | 2013.20140215-1ubuntu0.1 | USN-3401-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | texlive-kastrup | 2013.84.svn15878-21.3.1 | SUSE-SU-2024:1203-1 |
| SLES 12 SP5 | texlive-koma-script | 2013.84.3.11bsvn29774-21.3.1 | SUSE-SU-2024:1203-1 |
| SLES 12 SP5 | texlive-kpathsea | 2013.84.svn30218-21.3.1 | SUSE-SU-2024:1203-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | texlive | 2021.20210325.svn34398-76.3 | openSUSE-SU-2024:11431-1 |
| openSUSE Tumbleweed | texlive-specs-a | 2021.186.3.0_beta3svn33894-47.2 | openSUSE-SU-2024:11433-1 |
| openSUSE Tumbleweed | texlive-specs-b | 2021.186.svn19440-46.2 | openSUSE-SU-2024:11434-1 |
| openSUSE Tumbleweed | texlive-specs-c | 2021.186.svn15878-46.2 | openSUSE-SU-2024:11435-1 |
| openSUSE Tumbleweed | texlive-specs-d | 2021.186.2.1bsvn15878-45.2 | openSUSE-SU-2024:11436-1 |
| openSUSE Tumbleweed | texlive-specs-e | 2021.186.1.5svn55387-46.2 | openSUSE-SU-2024:11437-1 |
| openSUSE Tumbleweed | texlive-specs-f | 2021.186.1.5.7svn58590-46.2 | openSUSE-SU-2024:11438-1 |
| openSUSE Tumbleweed | texlive-specs-g | 2021.186.1.0svn54080-45.2 | openSUSE-SU-2024:11439-1 |
| openSUSE Tumbleweed | texlive-specs-h | 2021.186.1.0svn18115-46.3 | openSUSE-SU-2024:11440-1 |
| openSUSE Tumbleweed | texlive-specs-i | 2021.186.2.0bsvn56782-45.2 | openSUSE-SU-2024:11441-1 |
| openSUSE Tumbleweed | texlive-specs-j | 2021.186.1.6.0svn54732-45.2 | openSUSE-SU-2024:11442-1 |
| openSUSE Tumbleweed | texlive-specs-k | 2021.186.1.0fsvn22255-46.3 | openSUSE-SU-2024:11443-1 |
| openSUSE Tumbleweed | texlive-specs-l | 2021.186.1.2.2svn57773-45.2 | openSUSE-SU-2024:11444-1 |
| openSUSE Tumbleweed | texlive-specs-m | 2021.186.0.0.5.6svn53248-48.2 | openSUSE-SU-2024:11445-1 |
| openSUSE Tumbleweed | texlive-specs-n | 2021.187.svn55643-47.2 | openSUSE-SU-2024:11446-1 |
| openSUSE Tumbleweed | texlive-specs-o | 2021.186.1.5svn15878-45.2 | openSUSE-SU-2024:11447-1 |
| openSUSE Tumbleweed | texlive-specs-p | 2021.186.1.01svn41996-46.2 | openSUSE-SU-2024:11448-1 |
| openSUSE Tumbleweed | texlive-specs-q | 2021.186.0.0.1svn45601-47.3 | openSUSE-SU-2024:11449-1 |
| openSUSE Tumbleweed | texlive-specs-r | 2021.186.0.0.3.1svn55214-44.2 | openSUSE-SU-2024:11450-1 |
| openSUSE Tumbleweed | texlive-specs-s | 2021.186.0.0.3bsvn15878-45.2 | openSUSE-SU-2024:11451-1 |
| openSUSE Tumbleweed | texlive-specs-t | 2021.186.0.0.1svn15878-46.3 | openSUSE-SU-2024:11452-1 |
| openSUSE Tumbleweed | texlive-specs-u | 2021.186.1.2asvn15878-46.2 | openSUSE-SU-2024:11453-1 |
| openSUSE Tumbleweed | texlive-specs-v | 2021.186.0.0.1svn34495-50.3 | openSUSE-SU-2024:11454-1 |
| openSUSE Tumbleweed | texlive-specs-w | 2021.186.1.2svn54512-46.2 | openSUSE-SU-2024:11455-1 |
| openSUSE Tumbleweed | texlive-specs-x | 2021.186.1.3svn40772-45.2 | openSUSE-SU-2024:11456-1 |
| openSUSE Tumbleweed | texlive-specs-y | 2021.186.1.1svn48423-46.2 | openSUSE-SU-2024:11457-1 |
| openSUSE Tumbleweed | texlive-specs-z | 2021.186.17.7svn55862-45.3 | openSUSE-SU-2024:11458-1 |
Advisories 31
- DLA-847-1 texlive-base - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3803-1 texlive-base - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3401-1 texlive-base vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11439-1 texlive-datetime2-basque-2021.186.1.2asvn47064-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11442-1 texlive-float-2021.186.1.3dsvn15878-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11445-1 texlive-ionumbers-2021.186.0.0.3.3svn33457-48.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11440-1 texlive-dvdcoll-2021.186.1.1asvn15878-46.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11441-1 texlive-eskd-2021.186.svn15878-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11458-1 texlive-wrapfig-2021.186.3.6svn22048-45.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11451-1 texlive-plari-2021.186.svn15878-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11454-1 texlive-simplified-latex-2021.186.svn20620-50.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11457-1 texlive-ucharcat-2021.186.0.0.03svn38907-46.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11438-1 texlive-confproc-2021.186.0.0.8svn29349-46.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11437-1 texlive-chapterfolder-2021.186.2.0.1svn15878-46.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11444-1 texlive-hrlatex-2021.186.0.0.23svn18020-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11452-1 texlive-pst-pdf-2021.186.1.2fsvn56622-46.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11434-1 texlive-around-the-bend-2021.186.svn15878-46.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11449-1 texlive-na-box-2021.186.1.0svn45130-47.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11455-1 texlive-scripts-2021.186.svn58742-46.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11448-1 texlive-menu-2021.186.0.0.994svn15878-46.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11447-1 texlive-lshort-slovak-2021.186.svn15878-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11436-1 texlive-biolett-bst-2021.186.svn42217-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11446-1 texlive-latex-web-companion-2021.187.svn29349-47.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11456-1 texlive-tikz-dimline-2021.186.1.0svn35805-45.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11453-1 texlive-robustindex-2021.186.svn49877-46.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11450-1 texlive-overlays-2021.186.2.12svn57866-44.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11435-1 texlive-bbding-2021.186.1.01svn17186-46.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11443-1 texlive-gitfile-info-2021.186.0.0.5svn51928-46.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11431-1 libkpathsea6-6.3.3-76.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11433-1 texlive-12many-2021.186.0.0.3svn15878-47.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2024:1203-1 Security update for texlive-specs-k SUSE / openSUSE Security Updates · May 2, 2025
References
- https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/
- FEDORA-2017-a8add6c46c vendor-advisory
- https://www.tug.org/svn/texlive?view=revision&revision=42605
- GLSA-201709-07 vendor-advisory
- DSA-3803 vendor-advisory
- [oss-security] 20170305 TeX Live: CVE-2016-10243: whitelists a insecure binary/utility to be run as external program mailing-list
- 96593 vdb-entry
- FEDORA-2017-b72cafa5b4 vendor-advisory