The default configuration of the shell_escape_commands directive in…
Priority LOW 37CWE-16Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute arbitrary code via a crafted TeX document.
Why it matters now
EPSS 0.04061 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 80
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debian:tex-common:0.1:*:*:*:*:*:*:* | 0.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.2:*:*:*:*:*:*:* | 0.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.3:*:*:*:*:*:*:* | 0.3 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.4:*:*:*:*:*:*:* | 0.4 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.5:*:*:*:*:*:*:* | 0.5 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.6:*:*:*:*:*:*:* | 0.6 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.7:*:*:*:*:*:*:* | 0.7 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.8:*:*:*:*:*:*:* | 0.8 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.9:*:*:*:*:*:*:* | 0.9 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.10:*:*:*:*:*:*:* | 0.10 | Vulnerable | Debian |
- cpe:2.3:a:debian:tex-common:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.10:*:*:*:*:*:*:* Versions 0.10 Vulnerable ·Debian
Show 70 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debian:tex-common:0.11:*:*:*:*:*:*:* | 0.11 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.12:*:*:*:*:*:*:* | 0.12 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.13:*:*:*:*:*:*:* | 0.13 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.14:*:*:*:*:*:*:* | 0.14 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.15:*:*:*:*:*:*:* | 0.15 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.16:*:*:*:*:*:*:* | 0.16 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.17:*:*:*:*:*:*:* | 0.17 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.18:*:*:*:*:*:*:* | 0.18 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.19:*:*:*:*:*:*:* | 0.19 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.20:*:*:*:*:*:*:* | 0.20 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.21:*:*:*:*:*:*:* | 0.21 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.22:*:*:*:*:*:*:* | 0.22 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.23:*:*:*:*:*:*:* | 0.23 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.24:*:*:*:*:*:*:* | 0.24 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.25:*:*:*:*:*:*:* | 0.25 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.26:*:*:*:*:*:*:* | 0.26 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.27:*:*:*:*:*:*:* | 0.27 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.28:*:*:*:*:*:*:* | 0.28 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.29:*:*:*:*:*:*:* | 0.29 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.30:*:*:*:*:*:*:* | 0.30 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.31:*:*:*:*:*:*:* | 0.31 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.32:*:*:*:*:*:*:* | 0.32 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.33:*:*:*:*:*:*:* | 0.33 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.34:*:*:*:*:*:*:* | 0.34 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.35:*:*:*:*:*:*:* | 0.35 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.36:*:*:*:*:*:*:* | 0.36 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.37:*:*:*:*:*:*:* | 0.37 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.38:*:*:*:*:*:*:* | 0.38 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.39:*:*:*:*:*:*:* | 0.39 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.40:*:*:*:*:*:*:* | 0.40 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.41:*:*:*:*:*:*:* | 0.41 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.42:*:*:*:*:*:*:* | 0.42 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.43:*:*:*:*:*:*:* | 0.43 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:0.44:*:*:*:*:*:*:* | 0.44 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.2:*:*:*:*:*:*:* | 1.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.3:*:*:*:*:*:*:* | 1.3 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.4:*:*:*:*:*:*:* | 1.4 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.5:*:*:*:*:*:*:* | 1.5 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.6:*:*:*:*:*:*:* | 1.6 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.7:*:*:*:*:*:*:* | 1.7 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.8:*:*:*:*:*:*:* | 1.8 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.9:*:*:*:*:*:*:* | 1.9 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.10:*:*:*:*:*:*:* | 1.10 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.11:*:*:*:*:*:*:* | 1.11 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.11.1:*:*:*:*:*:*:* | 1.11.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.11.2:*:*:*:*:*:*:* | 1.11.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.11.3:*:*:*:*:*:*:* | 1.11.3 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.12:*:*:*:*:*:*:* | 1.12 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.13:*:*:*:*:*:*:* | 1.13 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.14:*:*:*:*:*:*:* | 1.14 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.15:*:*:*:*:*:*:* | 1.15 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.16:*:*:*:*:*:*:* | 1.16 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.17:*:*:*:*:*:*:* | 1.17 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.18:*:*:*:*:*:*:* | 1.18 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.19:*:*:*:*:*:*:* | 1.19 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:1.20:*:*:*:*:*:*:* | 1.20 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.00:*:*:*:*:*:*:* | 2.00 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.01:*:*:*:*:*:*:* | 2.01 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.02:*:*:*:*:*:*:* | 2.02 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.03:*:*:*:*:*:*:* | 2.03 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.04:*:*:*:*:*:*:* | 2.04 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.05:*:*:*:*:*:*:* | 2.05 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.06:*:*:*:*:*:*:* | 2.06 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.07:*:*:*:*:*:*:* | 2.07 | Vulnerable | Debian |
| cpe:2.3:a:debian:tex-common:2.08:*:*:*:*:*:*:* | 2.08 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:* | 10.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:* | 10.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:* | all versions | Vulnerable | Debian |
- cpe:2.3:a:debian:tex-common:0.11:*:*:*:*:*:*:* Versions 0.11 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.12:*:*:*:*:*:*:* Versions 0.12 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.13:*:*:*:*:*:*:* Versions 0.13 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.14:*:*:*:*:*:*:* Versions 0.14 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.15:*:*:*:*:*:*:* Versions 0.15 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.16:*:*:*:*:*:*:* Versions 0.16 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.17:*:*:*:*:*:*:* Versions 0.17 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.18:*:*:*:*:*:*:* Versions 0.18 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.19:*:*:*:*:*:*:* Versions 0.19 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.20:*:*:*:*:*:*:* Versions 0.20 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.21:*:*:*:*:*:*:* Versions 0.21 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.22:*:*:*:*:*:*:* Versions 0.22 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.23:*:*:*:*:*:*:* Versions 0.23 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.24:*:*:*:*:*:*:* Versions 0.24 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.25:*:*:*:*:*:*:* Versions 0.25 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.26:*:*:*:*:*:*:* Versions 0.26 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.27:*:*:*:*:*:*:* Versions 0.27 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.28:*:*:*:*:*:*:* Versions 0.28 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.29:*:*:*:*:*:*:* Versions 0.29 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.30:*:*:*:*:*:*:* Versions 0.30 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.31:*:*:*:*:*:*:* Versions 0.31 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.32:*:*:*:*:*:*:* Versions 0.32 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.33:*:*:*:*:*:*:* Versions 0.33 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.34:*:*:*:*:*:*:* Versions 0.34 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.35:*:*:*:*:*:*:* Versions 0.35 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.36:*:*:*:*:*:*:* Versions 0.36 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.37:*:*:*:*:*:*:* Versions 0.37 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.38:*:*:*:*:*:*:* Versions 0.38 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.39:*:*:*:*:*:*:* Versions 0.39 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.40:*:*:*:*:*:*:* Versions 0.40 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.41:*:*:*:*:*:*:* Versions 0.41 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.42:*:*:*:*:*:*:* Versions 0.42 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.43:*:*:*:*:*:*:* Versions 0.43 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:0.44:*:*:*:*:*:*:* Versions 0.44 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.11.3:*:*:*:*:*:*:* Versions 1.11.3 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.00:*:*:*:*:*:*:* Versions 2.00 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.01:*:*:*:*:*:*:* Versions 2.01 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.02:*:*:*:*:*:*:* Versions 2.02 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.04:*:*:*:*:*:*:* Versions 2.04 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.05:*:*:*:*:*:*:* Versions 2.05 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.06:*:*:*:*:*:*:* Versions 2.06 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.07:*:*:*:*:*:*:* Versions 2.07 Vulnerable ·Debian
- cpe:2.3:a:debian:tex-common:2.08:*:*:*:*:*:*:* Versions 2.08 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:* Versions 10.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:* Versions 10.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Debian
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2011-1400
- 2026-10-03 Alias added: GHSA-3hcf-872f-8qrc
References
Sources
- CVE-2011-1400 · CVE Program
- CVE-2011-1400 · NVD
- FIRST EPSS
- GHSA-3hcf-872f-8qrc · GitHub Advisory Database · CC BY 4.0
- CVE-2011-1400 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences