[ GLSA 201709-07 ] Kpathsea

[GLSA]

Gentoo Linux Security Advisory

Title: Kpathsea: User-assisted execution of arbitrary code (GLSA 201709-07)
Severity: normal
Exploitable: remote
Date: 2017-09-17
Bug(s): #612328
ID: 201709-07

Synopsis

A vulnerability in Kpathsea allows remote attackers to execute
arbitrary commands by manipulating the -tex option from mpost program.


Background

Kpathsea is a library to do path searching. It is used by TeX Live and
others TeX related software.


Affected Packages

Package: dev-libs/kpathsea
Vulnerable: < 6.2.2_p20160523
Unaffected: >= 6.2.2_p20160523
Architectures: All supported architectures


Description

It was discovered that the mpost program from the shell_escape_commands
list is capable of executing arbitrary external programs during the
conversion of .tex files. The responsible function is runpopen()
(texmfmp.c).


Impact

A remote attacker, by enticing a user to open a specially crafted .tex
file, could possibly execute arbitrary code with the privileges of the
process.


Workaround

There is no known workaround at this time.

Resolution

All Kpathsea users should upgrade to the latest version: