CVE-2011-1400

The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in...

6.8 MediumFix available

The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute arbitrary code via a crafted TeX document.

Exploit likelihood

4.06%Down 5.9 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2011-1400
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-16
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-1400
Updated: 2026-11-02

EUVDEUVD-2011-1407 No score

Record: EUVD-2011-1407
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3hcf-872f-8qrc No score

The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in...

Record: GHSA-3hcf-872f-8qrc
Updated: 2026-11-02

OSV No score

Record: CVE-2011-1400
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-1400 No score

Record: DEBIAN-CVE-2011-1400
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`tex-common` Debian:12	before 2.09	2.09
`tex-common` Debian:13	before 2.09	2.09
`tex-common` Debian:14	before 2.09	2.09
`tex-common` Debian:6.0	before 2.08.1, plus listed versions 2.08	2.08.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-1400 is a medium vulnerability (CVSS 6.8) in Debian Linux, published March 22, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.06%, the 90th percentile. Fixed in tex-common 2.09.

References

Show 8 moreShow less