Forkosh develops a narrow portfolio of mathematical rendering and typesetting utilities, principally MathTeX and MimeTeX, which convert mathematical notation into images for web and document embedding. The vulnerabilities affecting these products cluster around memory-safety issues such as buffer-boundary violations and code-injection weaknesses inherent to parsing and rendering untrusted mathematical input. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Forkosh over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-1382HIGH Multiple stack-based buffer overflows in mimetex.cgi in mimeTeX, when downloaded before 20090713, allow remote attackers to execute arbitrary code via a TeX file with long (1) pict | Jul 14, 2009 | 10.0 | 36 | NO | NO |
CVE-2009-2459HIGH Multiple unspecified vulnerabilities in mimeTeX, when downloaded before 20090713, have unknown impact and attack vectors related to the (1) \environ, (2) \input, and (3) \counter T | Jul 14, 2009 | 10.0 | 32 | NO | NO |
CVE-2009-2460HIGH Multiple stack-based buffer overflows in mathtex.cgi in mathTeX, when downloaded before 20090713, have unspecified impact and remote attack vectors. | Jul 14, 2009 | 10.0 | 28 | NO | NO |
CVE-2009-1383HIGH The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag. | Jul 14, 2009 | 7.5 | 23 | NO | NO |
CVE-2009-2461HIGH mathtex.cgi in mathTeX, when downloaded before 20090713, does not securely create temporary files, which has unspecified impact and local attack vectors. | Jul 14, 2009 | 7.2 | 21 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Forkosh.
Media articles that mention a CVE ID that affects a product developed by Forkosh — matched by CVE ID, not by vendor name.