CVE-2015-5700

What it actually does

Local symlink attack in mktexlsr allows writing to arbitrary files by manipulating symbolic links during file operations in texlive packaging.

Why it matters to the business

Local attackers can corrupt or overwrite arbitrary system files, risking data loss, configuration changes, or escalation to broader system compromise on affected document processing environments.

How an attack unfolds

An attacker with local access creates a symlink pointing to a sensitive target file, then invokes the vulnerable mktexlsr revision which follows the link and performs an unintended write operation.

How to fix it

Upgrade texlive to a version that resolves the symlink handling flaw in mktexlsr revisions after 36625; restrict untrusted local user execution of texlive utilities where possible.

How to confirm the fix worked

Review source history or test mktexlsr behavior with symlinks to confirm writes are no longer permitted to arbitrary locations outside intended directories.

Typical attack path

1. Identify a writable directory used by mktexlsr
2. Create a symlink from a controlled path to an arbitrary target file
3. Trigger mktexlsr execution to perform the write operation through the symlink
4. Verify or leverage the resulting file modification

How to detect it

Search process execution logs and file system audit trails for mktexlsr invocations followed by unexpected writes or symlink creations in non-standard locations.

What your security team should do

• Prioritize patching texlive installations on multi-user systems
• Audit local user permissions and remove unnecessary access to texlive tools
• Implement file integrity monitoring on critical system paths
• Review historical logs for evidence of symlink abuse if systems remain unpatched