CVE-2011-1400

The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute arbitrary code via a crafted TeX document.

• CWE-16

• http://secunia.com/advisories/43816Vendor Advisory
• http://secunia.com/advisories/43973Vendor Advisory
• http://svn.debian.org/wsvn/debian-tex/?op=comp&compare%5B%5D=%2Ftex-common%2Ftrunk%404781&compare%5B%5D=%2Ftex-common%2Ftrunk%404812
• http://svn.debian.org/wsvn/debian-tex/tex-common/trunk/?op=log
• http://www.debian.org/security/2011/dsa-2198
• http://www.securityfocus.com/bid/46986
• http://www.ubuntu.com/usn/USN-1103-1
• http://www.vupen.com/english/advisories/2011/0731Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0861Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66249
• http://secunia.com/advisories/43816Vendor Advisory
• http://secunia.com/advisories/43973Vendor Advisory
• http://svn.debian.org/wsvn/debian-tex/?op=comp&compare%5B%5D=%2Ftex-common%2Ftrunk%404781&compare%5B%5D=%2Ftex-common%2Ftrunk%404812
• http://svn.debian.org/wsvn/debian-tex/tex-common/trunk/?op=log
• http://www.debian.org/security/2011/dsa-2198
• http://www.securityfocus.com/bid/46986
• http://www.ubuntu.com/usn/USN-1103-1
• http://www.vupen.com/english/advisories/2011/0731Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0861Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66249

Published

Mar 25, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-1393Unspecified vulnerability in the authentication functionalit…
• CVE-2011-1394IBM Maximo Asset Management and Asset Management Essentials …
• CVE-2011-1395Cross-site scripting (XSS) vulnerability in imicon.jsp in IB…
• CVE-2011-1396Cross-site scripting (XSS) vulnerability in IBM Maximo Asset…
• CVE-2011-1397Cross-site request forgery (CSRF) vulnerability in the Labor…
• CVE-2011-1398The sapi_header_op function in main/SAPI.c in PHP before 5.3…
• CVE-2011-1401ikiwiki before 3.20110328 does not ascertain whether the htm…
• CVE-2011-1402Mahara before 1.3.6 allows remote authenticated users to byp…
• CVE-2011-1403Cross-site request forgery (CSRF) vulnerability in the piefo…
• CVE-2011-1404Mahara before 1.3.6 does not properly restrict the data in r…
• CVE-2011-1405Cross-site scripting (XSS) vulnerability in Mahara before 1.…
• CVE-2011-1406Mahara before 1.3.6 does not properly handle an https URL in…