{"id":"CVE-2015-8106","aliases":["DEBIAN-CVE-2015-8106","EUVD-2015-7998","GHSA-4764-m84f-xpjw","MGASA-2015-0453","UBUNTU-CVE-2015-8106"],"status":"published","title":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10...","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03556,"percentile":0.89404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2015-11-19T22:08:19Z","modified":"2026-09-09T07:01:41Z","fixes":[{"ecosystem":"Debian:12","package":"latex2rtf","fixed_in":["2.3.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"latex2rtf","fixed_in":["2.3.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"latex2rtf","fixed_in":["2.3.10-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"latex2rtf","fixed_in":["2.3.8-3.1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"latex2rtf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"latex2rtf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"latex2rtf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"latex2rtf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"latex2rtf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"latex2rtf_project","product":"latex2rtf"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/11/16/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181276.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://sourceforge.net/p/latex2rtf/code/1244/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181677.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181725.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1282492","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8106"},{"url":"https://sourceforge.net/p/latex2rtf/code/1244"},{"url":"https://github.com/advisories/GHSA-4764-m84f-xpjw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8106","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0453.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17164","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/11/16/3","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8106","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8106","tags":["report"]},{"url":"http://sourceforge.net/p/latex2rtf/code/1152/tree//trunk/funct1.c?diff=50900fed34309d3c639c868f:1151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8106","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8106","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","status":"published","published":"2016-04-18T14:00:00Z","modified":"2024-08-06T08:13:31.044Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2015-7998","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","status":"published","published":"2016-04-18T14:00:00Z","modified":"2024-08-06T08:13:31Z","updated_at":"2026-11-03T01:57:28.296316Z"}],"ghsa":[{"id":"GHSA-4764-m84f-xpjw","title":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10...","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","status":"published","published":"2022-05-17T03:55:15Z","modified":"2025-04-12T12:59:50Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:01:26.909163Z"}],"nvd":[{"id":"CVE-2015-8106","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","status":"published","published":"2016-04-18T14:59:01.72Z","modified":"2026-06-17T00:34:03.387Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-8106","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","status":"published","published":"2016-04-18T14:59:01Z","modified":"2026-04-16T06:24:21.320007915Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8106","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","status":"published","published":"2016-04-18T14:59:01.72Z","modified":"2026-09-09T07:01:41.741591325Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-8106","description":"Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\keywords command in a crafted TeX file.","status":"published","published":"2016-04-18T14:59:00Z","modified":"2025-10-24T04:45:29Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"MGASA-2015-0453","title":"Updated latex2rtf packages fix security vulnerability","description":"A format string vulnerability was found in CmdKeywords function when\nprocessing \\keywords command in tex file. When the user runs latex2rtf\nwith malicious crafted tex file, an attacker can execute arbitrary code.\nThe variable 'keywords' in the function CmdKeywords may hold a malicious\ninput string, which can be used as a format argument of vsnprintf\n(CVE-2015-8106).\n","status":"published","published":"2015-11-19T22:08:19Z","modified":"2026-04-16T06:25:49.67053902Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}