summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--Build/source/texk/kpathsea/ChangeLog6
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf4
-rw-r--r--Master/texmf/web2c/texmf.cnf4
3 files changed, 14 insertions, 0 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog
index 2c56a6fe1af..728601eef65 100644
--- a/Build/source/texk/kpathsea/ChangeLog
+++ b/Build/source/texk/kpathsea/ChangeLog
@@ -1,3 +1,9 @@
+2010-09-18 Karl Berry <karl@tug.org>
+
+ * texmf.cnf (DVIPDFMXINPUTS): do not include ., so attackers
+ cannot create a dvipdfmx.cfg with, e.g., xetex.
+ Report from Heiko, 16 Sep 2010 22:32:25.
+
2010-09-09 Karl Berry <karl@tug.org>
* mktexlsr (vc_dirs): remove CVS and RCS from the list,
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index 2bdfe3dcf6b..42c6ddde4ed 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -428,6 +428,10 @@ TEX4HTINPUTS = .;$TEXMF/tex4ht/base//;$TEXMF/tex4ht/ht-fonts/{$TEX4HTFONTSET}//
TW_LIBPATH = $TEXMFCONFIG/texworks
TW_INIPATH = $TW_LIBPATH
+% For security, do not look in . for dvipdfmx.cfg, since the D option
+% would allow command execution.
+DVIPDFMXINPUTS = $TEXMF/dvipdfmx
+
% Find scripts that are distributed/installed in the texmf tree.
% Lua needs to look in TEXINPUTS for lua scripts distributed with packages.
diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf
index 2bdfe3dcf6b..42c6ddde4ed 100644
--- a/Master/texmf/web2c/texmf.cnf
+++ b/Master/texmf/web2c/texmf.cnf
@@ -428,6 +428,10 @@ TEX4HTINPUTS = .;$TEXMF/tex4ht/base//;$TEXMF/tex4ht/ht-fonts/{$TEX4HTFONTSET}//
TW_LIBPATH = $TEXMFCONFIG/texworks
TW_INIPATH = $TW_LIBPATH
+% For security, do not look in . for dvipdfmx.cfg, since the D option
+% would allow command execution.
+DVIPDFMXINPUTS = $TEXMF/dvipdfmx
+
% Find scripts that are distributed/installed in the texmf tree.
% Lua needs to look in TEXINPUTS for lua scripts distributed with packages.