CVE Vulnerabilities

CVE-2015-8106

Use of Externally-Controlled Format String

Published: Apr 18, 2016 | Modified: Apr 12, 2025
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the keywords command in a crafted TeX file.

Weakness

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected Software

Name Vendor Start Version End Version
Latex2rtf Latex2rtf_project 2.3.8 (including) 2.3.8 (including)
Latex2rtf Ubuntu artful *
Latex2rtf Ubuntu esm-apps/xenial *
Latex2rtf Ubuntu precise *
Latex2rtf Ubuntu trusty *
Latex2rtf Ubuntu upstream *
Latex2rtf Ubuntu vivid *
Latex2rtf Ubuntu wily *
Latex2rtf Ubuntu xenial *
Latex2rtf Ubuntu yakkety *
Latex2rtf Ubuntu zesty *

Potential Mitigations

References