CVE-2009-1383

Published: Jul 14, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag.

Affected (1)

Products: Forkosh: Mathtex

Forkosh

1 product

Mathtex

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Forkosh Mathtex	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (12)

http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578

Source: secalert@redhat.com

http://secunia.com/advisories/35816

Source: secalert@redhat.com

Vendor Advisory

http://www.ocert.org/advisories/ocert-2009-010.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/504919/100/0/threaded

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1875

Source: secalert@redhat.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/51795

Source: secalert@redhat.com

http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578