Lucene search

K
mageiaGentoo FoundationMGASA-2024-0108
HistoryApr 05, 2024 - 9:24 p.m.

Updated texlive-20220321 packages fix security vulnerabilities

2024-04-0521:24:25
Gentoo Foundation
advisories.mageia.org
22
luatex arbitrary network requests
socket library access
tex live vulnerabilities
miktex vulnerabilities
heap buffer overflow
ttfloadhdmx:ttfdump function
crafted ttf file
denial of service
unix

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

27.0%

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32668) texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file. (CVE-2024-25262)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchtexlive< 20220321-7.1texlive-20220321-7.1.mga9

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

27.0%