CVE-2017-17513: High severity Tug Tex Live vulnerability

Q: What is CVE-2017-17513?

CVE-2017-17513 is a vulnerability in TeX Live through 20170524 that allows remote attackers to conduct argument-injection attacks via a crafted URL.

Q: How does CVE-2017-17513 affect TeX Live?

CVE-2017-17513 affects TeX Live through 20170524.

Q: What is the severity of CVE-2017-17513?

CVE-2017-17513 has a severity rating of 8.8 (high).

Q: What software packages are affected by CVE-2017-17513?

The software packages affected by CVE-2017-17513 include 'context', 'texlive-base', 'texlive-bin', and 'Tug Tex Live'.

Q: Are there any fixes or remedies available for CVE-2017-17513?

No fixes or remedies are currently available for CVE-2017-17513.

Published Dec 14, 2017

Updated

TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linkedscripts/context/stubs/unix/mtxrun, texmf-dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua.

Affected Software

4 affected components

Tug Tex Live<=20170524

debian/context<=2020.03.10.20200331-1, <=2020.03.10.20200331-1+deb11u1, <=2021.03.05.20230120+dfsg-1+deb12u1, <=2024.04.01.20240428+dfsg-2, <=2025.09.21.20251026+dfsg-1

debian/texlive-base<=2020.20210202-3, <=2022.20230122-3, <=2024.20250309-1, <=2025.20260124-1

debian/texlive-bin<=2020.20200327.54578-7+deb11u1, <=2020.20200327.54578-7+deb11u2, <=2022.20220321.62855-5.1+deb12u2, <=2024.20240313.70630+ds-6, <=2025.20250727.75242+ds-5

Event History

Dec 14, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Feb 19, 2026

Data Sourced

via Debian·10:01 PM

DescriptionAffected Software

Frequently Asked Questions

What is CVE-2017-17513?

CVE-2017-17513 is a vulnerability in TeX Live through 20170524 that allows remote attackers to conduct argument-injection attacks via a crafted URL.

How does CVE-2017-17513 affect TeX Live?

CVE-2017-17513 affects TeX Live through 20170524.

What is the severity of CVE-2017-17513?

CVE-2017-17513 has a severity rating of 8.8 (high).

What software packages are affected by CVE-2017-17513?

The software packages affected by CVE-2017-17513 include 'context', 'texlive-base', 'texlive-bin', and 'Tug Tex Live'.

Are there any fixes or remedies available for CVE-2017-17513?