Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-1894: TEXutil in ConTEXt can let local user replace any file

CVE-2004-1894 · published 21 years ago

Summary

When the TEXutil program in ConTEXt is started with the --silent flag, it writes to a file called texutil.log. A user on the same computer can point that log file to a different location using a symbolic link, causing TEXutil to overwrite whatever file the link targets. To protect your data, apply any available updates for ConTEXt or avoid using the --silent option until the issue is fixed.

Original advisory text

TEXutil in ConTEXt, when executed with the --silent option, allows local users to overwrite arbitrary files via a symlink attack on texutil.log.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Timeline

Published31 Dec 2004

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2004-1894 · NVD

Track software like this

Free during beta