CVE-2015-8106

Published: Apr 18, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.

Affected (4)

Products: Latex2rtf Project: Latex2rtf · Fedoraproject: Fedora

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Latex2rtf Project Latex2rtf	Version 2.3.8

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 22
Fedoraproject Fedora	Version 23
Fedoraproject Fedora	Version 24

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (12)

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181276.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181677.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181725.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/11/16/3

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1282492

Source: cve@mitre.org

https://sourceforge.net/p/latex2rtf/code/1244/

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181276.html