CVE-2015-0296 The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file....
MediumCVSS 4.7
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tug texlive | = 6.20131226_r32488.fc20 | No fix listed |
| tug texlive | = 3.1.20140525_r34255.fc21 | No fix listed |
References
- FEDORA-2015-4332 third-party-advisory vendor-advisory
- FEDORA-2015-4872 third-party-advisory vendor-advisory
- [oss-security] 20150227 CVE-2015-0296 preinstall scriptlet in texlive-base rpm of fedora allows unprivileged user to delete arbitrary files(maybe others) mailing-list third-party-advisory
- 72826 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- Debian Security Tracker CVE-2015-0296 vendor-advisory