All packages
TeX Live vulnerabilities
3 known CVE vulnerabilities in TeX Live, translated and rated.
- CVE-2017-17513High
TeX Live through version 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- CVE-2016-10243Critical
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.
- CVE-2026-63729Medium
The SyncTeX parser (synctex_parser.c) in TeX Live and downstream applications like GNOME Evince contains a heap use-after-free vulnerability. Attackers can crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file.