diff options
| -rw-r--r-- | Build/source/texk/kpathsea/ChangeLog | 6 | ||||
| -rw-r--r-- | Build/source/texk/kpathsea/texmf.cnf | 4 | ||||
| -rw-r--r-- | Master/texmf/web2c/texmf.cnf | 4 |
3 files changed, 14 insertions, 0 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index 2c56a6fe1af..728601eef65 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,9 @@ +2010-09-18 Karl Berry <karl@tug.org> + + * texmf.cnf (DVIPDFMXINPUTS): do not include ., so attackers + cannot create a dvipdfmx.cfg with, e.g., xetex. + Report from Heiko, 16 Sep 2010 22:32:25. + 2010-09-09 Karl Berry <karl@tug.org> * mktexlsr (vc_dirs): remove CVS and RCS from the list, diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf index 2bdfe3dcf6b..42c6ddde4ed 100644 --- a/Build/source/texk/kpathsea/texmf.cnf +++ b/Build/source/texk/kpathsea/texmf.cnf @@ -428,6 +428,10 @@ TEX4HTINPUTS = .;$TEXMF/tex4ht/base//;$TEXMF/tex4ht/ht-fonts/{$TEX4HTFONTSET}// TW_LIBPATH = $TEXMFCONFIG/texworks TW_INIPATH = $TW_LIBPATH +% For security, do not look in . for dvipdfmx.cfg, since the D option +% would allow command execution. +DVIPDFMXINPUTS = $TEXMF/dvipdfmx + % Find scripts that are distributed/installed in the texmf tree. % Lua needs to look in TEXINPUTS for lua scripts distributed with packages. diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf index 2bdfe3dcf6b..42c6ddde4ed 100644 --- a/Master/texmf/web2c/texmf.cnf +++ b/Master/texmf/web2c/texmf.cnf @@ -428,6 +428,10 @@ TEX4HTINPUTS = .;$TEXMF/tex4ht/base//;$TEXMF/tex4ht/ht-fonts/{$TEX4HTFONTSET}// TW_LIBPATH = $TEXMFCONFIG/texworks TW_INIPATH = $TW_LIBPATH +% For security, do not look in . for dvipdfmx.cfg, since the D option +% would allow command execution. +DVIPDFMXINPUTS = $TEXMF/dvipdfmx + % Find scripts that are distributed/installed in the texmf tree. % Lua needs to look in TEXINPUTS for lua scripts distributed with packages. |