CVE-2015-5700
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write...
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- Record
CVE-2015-5700- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - CVSS 2.0
- 5.6 Medium
AV:L/AC:L/Au:N/C:P/I:C/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- Record
CVE-2015-5700- Updated
- 2026-11-02
EUVDEUVD-2015-5647 No score
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- Record
EUVD-2015-5647- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hqv5-49rw-222p
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write...
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- Record
GHSA-hqv5-49rw-222p- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- Record
CVE-2015-5700- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-5700
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- Record
DEBIAN-CVE-2015-5700- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-5700
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- Record
UBUNTU-CVE-2015-5700- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVUSN-3788-1 No score
texlive-bin vulnerabilities
Jakub Wilk discovered that Tex Live incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-5700)
It was discovered that Tex Live incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-17407)
- Record
USN-3788-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
texlive-binDebian:12 |
before 2014.20140926.35254-5 | 2014.20140926.35254-5 |
texlive-binDebian:13 |
before 2014.20140926.35254-5 | 2014.20140926.35254-5 |
texlive-binDebian:14 |
before 2014.20140926.35254-5 | 2014.20140926.35254-5 |
texlive-binUbuntu:14.04:LTS |
before 2013.20130729.30972-2ubuntu0.1, plus listed versions 2013.20130529.30792-1build22013.20130729.30972-22013.20130729.30972-2build12013.20130729.30972-2build22013.20130729.30972-2build3 |
2013.20130729.30972-2ubuntu0.1 |
texlive-binUbuntu:14.04:LTS From an advisory covering 2 CVEs |
before 2013.20130729.30972-2ubuntu0.1, plus listed versions 2013.20130529.30792-1build22013.20130729.30972-22013.20130729.30972-2build12013.20130729.30972-2build22013.20130729.30972-2build3 |
2013.20130729.30972-2ubuntu0.1 |
texlive-binUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 2015.20160222.37495-1ubuntu0.1, plus listed versions 2015.20150524.37493-5build12015.20150524.37493-72015.20150524.37493-7build12015.20150524.37493-7build42015.20160222.37495-1 |
2015.20160222.37495-1ubuntu0.1 |
texlive-binUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 2017.20170613.44572-8ubuntu0.1, plus listed versions 2017.20170613.44572-5build12017.20170613.44572-5build22017.20170613.44572-62017.20170613.44572-6build12017.20170613.44572-6ubuntu12017.20170613.44572-8build1 |
2017.20170613.44572-8ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5700 is a medium vulnerability (CVSS 6.1) in Tug Texlive, published August 25, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in texlive-bin 2014.20140926.35254-5.
References
openwall.com/lists/oss-security/2015/07/30/6
bugs.debian.org/cgi-bin/bugreport.cgi?bug=775139
tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?view=log
bugzilla.redhat.com/show_bug.cgi?id=1181167
usn.ubuntu.com/3788-1
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-5700
github.com/advisories/GHSA-hqv5-49rw-222p
security-tracker.debian.org/tracker/CVE-2015-5700
ubuntu.com/security/CVE-2015-5700
cve.org/CVERecord?id=CVE-2015-5700