CVE-2016-10243

TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.

It was discovered that texlive whitelists mpost as an external program to be run from within the TeX source code (called \write18). Since mpost allows to specify other programs to be run, an attacker can take advantage of this flaw for arbitrary code execution when compiling a TeX document (CVE-2016-10243).

These are all security issues fixed in the libkpathsea6-6.3.3-76.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-12many-2021.186.0.0.3svn15878-47.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-around-the-bend-2021.186.svn15878-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-bbding-2021.186.1.01svn17186-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-biolett-bst-2021.186.svn42217-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-chapterfolder-2021.186.2.0.1svn15878-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-confproc-2021.186.0.0.8svn29349-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-datetime2-basque-2021.186.1.2asvn47064-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-dvdcoll-2021.186.1.1asvn15878-46.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-eskd-2021.186.svn15878-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-float-2021.186.1.3dsvn15878-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-gitfile-info-2021.186.0.0.5svn51928-46.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-hrlatex-2021.186.0.0.23svn18020-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-ionumbers-2021.186.0.0.3.3svn33457-48.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-latex-web-companion-2021.187.svn29349-47.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-lshort-slovak-2021.186.svn15878-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-menu-2021.186.0.0.994svn15878-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-na-box-2021.186.1.0svn45130-47.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-overlays-2021.186.2.12svn57866-44.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-plari-2021.186.svn15878-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-pst-pdf-2021.186.1.2fsvn56622-46.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-robustindex-2021.186.svn49877-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-simplified-latex-2021.186.svn20620-50.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-scripts-2021.186.svn58742-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-tikz-dimline-2021.186.1.0svn35805-45.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-ucharcat-2021.186.0.0.03svn38907-46.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the texlive-wrapfig-2021.186.3.6svn22048-45.3 package on the GA media of openSUSE Tumbleweed.

This update for texlive-specs-k fixes the following issues:

CVE-2016-10243: Fixed arbitrary code execution via mpost during TeX document compilation (bsc#1028271)

It was discovered that TeX Live incorrectly handled certain system commands. If a user were tricked into processing a specially crafted TeX file, a remote attacker could execute arbitrary code.