CVE-2017-17513 TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks...
HighCVSS 8.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linked_scripts/context/stubs/unix/mtxrun, texmf-dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/context(Debian:12) | All versions | No fix listed |
| debian/context(Debian:12) | = 2021.03.05.20230120+dfsg-1 | No fix listed |
| debian/context(Debian:12) | = 2021.03.05.20230120+dfsg-1+deb12u1 | No fix listed |
| debian/context(Debian:12) | = 2021.03.05.20230120+dfsg-2 | No fix listed |
| debian/context(Debian:12) | = 2023.05.05.20230730+dfsg-1 | No fix listed |
| debian/context(Debian:12) | = 2023.05.05.20230730+dfsg-2 | No fix listed |
| debian/context(Debian:12) | = 2024.04.01.20240428+dfsg-1 | No fix listed |
| debian/context(Debian:12) | = 2024.04.01.20240428+dfsg-2 | No fix listed |
| debian/context(Debian:12) | = 2025.03.05.20250324+dfsg-1 | No fix listed |
| debian/context(Debian:12) | = 2025.03.05.20250324+dfsg-2 | No fix listed |
| debian/context(Debian:12) | = 2025.03.05.20250324+dfsg-3 | No fix listed |
| debian/context(Debian:12) | = 2025.09.21.20251026+dfsg-1 | No fix listed |
| debian/context(Debian:13) | All versions | No fix listed |
| debian/context(Debian:13) | = 2024.04.01.20240428+dfsg-2 | No fix listed |
| debian/context(Debian:13) | = 2025.03.05.20250324+dfsg-1 | No fix listed |
| debian/context(Debian:13) | = 2025.03.05.20250324+dfsg-2 | No fix listed |
| debian/context(Debian:13) | = 2025.03.05.20250324+dfsg-3 | No fix listed |
| debian/context(Debian:13) | = 2025.09.21.20251026+dfsg-1 | No fix listed |
| debian/context(Debian:14) | All versions | No fix listed |
| debian/context(Debian:14) | = 2024.04.01.20240428+dfsg-2 | No fix listed |
| debian/context(Debian:14) | = 2025.03.05.20250324+dfsg-1 | No fix listed |
| debian/context(Debian:14) | = 2025.03.05.20250324+dfsg-2 | No fix listed |
| debian/context(Debian:14) | = 2025.03.05.20250324+dfsg-3 | No fix listed |
| debian/context(Debian:14) | = 2025.09.21.20251026+dfsg-1 | No fix listed |
| debian/texlive-base(Debian:12) | All versions | No fix listed |
Show 147 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/texlive-base(Debian:12) | = 2022.20230122-3 | No fix listed |
| debian/texlive-base(Debian:12) | = 2023.20230613-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2023.20230613-2 | No fix listed |
| debian/texlive-base(Debian:12) | = 2023.20230613-3 | No fix listed |
| debian/texlive-base(Debian:12) | = 2023.20231007-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2023.20231207-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2023.20240207-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20240401-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20240401-2 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20240401-3 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20240706-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20240829-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20240829-2 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20241102-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20241115-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20250114-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2024.20250309-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20250727-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20250727-2 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20250727-3 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20250927-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20250927-2 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20250927-3 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20250927-4 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20251127-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2025.20260124-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260328-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260328-2 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260328-3 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260328-4 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260527-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260527-2 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260527-3 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260711-1 | No fix listed |
| debian/texlive-base(Debian:12) | = 2026.20260711-2 | No fix listed |
| debian/texlive-base(Debian:13) | All versions | No fix listed |
| debian/texlive-base(Debian:13) | = 2024.20250309-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20250727-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20250727-2 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20250727-3 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20250927-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20250927-2 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20250927-3 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20250927-4 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20251127-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2025.20260124-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260328-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260328-2 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260328-3 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260328-4 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260527-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260527-2 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260527-3 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260711-1 | No fix listed |
| debian/texlive-base(Debian:13) | = 2026.20260711-2 | No fix listed |
| debian/texlive-base(Debian:14) | All versions | No fix listed |
| debian/texlive-base(Debian:14) | = 2024.20250309-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20250727-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20250727-2 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20250727-3 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20250927-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20250927-2 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20250927-3 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20250927-4 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20251127-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2025.20260124-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260328-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260328-2 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260328-3 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260328-4 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260527-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260527-2 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260527-3 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260711-1 | No fix listed |
| debian/texlive-base(Debian:14) | = 2026.20260711-2 | No fix listed |
| debian/texlive-bin(Debian:12) | All versions | No fix listed |
| debian/texlive-bin(Debian:12) | = 2022.20220321.62855-5.1 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2022.20220321.62855-5.1+deb12u1 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2022.20220321.62855-5.1+deb12u2 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2022.20220321.62855-6 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2022.20220321.62855-7 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2022.20220321.62855-8 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-1 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-2 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-3 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-4 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-5 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-6 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-7 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-8 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2023.20230311.66589-9 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2024.20240313.70630+ds-1 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2024.20240313.70630+ds-2 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2024.20240313.70630+ds-3 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2024.20240313.70630+ds-4 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2024.20240313.70630+ds-5 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2024.20240313.70630+ds-6 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2025.20250727.75242+ds-1 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2025.20250727.75242+ds-2 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2025.20250727.75242+ds-3 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2025.20250727.75242+ds-4 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2025.20250727.75242+ds-5 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2025.20250727.75242+ds-5~hurd.1 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2026.20260303.78225+ds-1 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2026.20260303.78225+ds-2 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2026.20260303.78225+ds-3 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2026.20260303.78225+ds-4 | No fix listed |
| debian/texlive-bin(Debian:12) | = 2026.20260303.78225+ds-5 | No fix listed |
| debian/texlive-bin(Debian:13) | All versions | No fix listed |
| debian/texlive-bin(Debian:13) | = 2024.20240313.70630+ds-6 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2025.20250727.75242+ds-1 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2025.20250727.75242+ds-2 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2025.20250727.75242+ds-3 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2025.20250727.75242+ds-4 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2025.20250727.75242+ds-5 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2025.20250727.75242+ds-5~hurd.1 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2026.20260303.78225+ds-1 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2026.20260303.78225+ds-2 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2026.20260303.78225+ds-3 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2026.20260303.78225+ds-4 | No fix listed |
| debian/texlive-bin(Debian:13) | = 2026.20260303.78225+ds-5 | No fix listed |
| debian/texlive-bin(Debian:14) | All versions | No fix listed |
| debian/texlive-bin(Debian:14) | = 2024.20240313.70630+ds-6 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2025.20250727.75242+ds-1 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2025.20250727.75242+ds-2 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2025.20250727.75242+ds-3 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2025.20250727.75242+ds-4 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2025.20250727.75242+ds-5 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2025.20250727.75242+ds-5~hurd.1 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2026.20260303.78225+ds-1 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2026.20260303.78225+ds-2 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2026.20260303.78225+ds-3 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2026.20260303.78225+ds-4 | No fix listed |
| debian/texlive-bin(Debian:14) | = 2026.20260303.78225+ds-5 | No fix listed |
| tug tex live | <= 20170524 | No fix listed |
| ubuntu/context(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/texlive-base(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/texlive-bin(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/context(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/texlive-base(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/texlive-bin(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/context(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/texlive-base(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/texlive-bin(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/context(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/texlive-base(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/texlive-bin(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-17513 third-party-advisory vendor-advisory