PT-2024-13324 · Tex Live +2 · Tex Live +2

Name of the Vulnerable Software and Affected Versions: TeX Live version 944e257 Description: The issue in TeX Live allows a NULL pointer dereference in the tounicode.c file, located in texk/web2c/pdftexdir. However, it is noted that this issue is disputed and might be categorized as a usability...

PT-2024-13321 · Tex Live +2 · Tex Live +2

Name of the Vulnerable Software and Affected Versions: Tex Live version 944e257 Description: The issue is related to a NULL pointer dereference in the writet1.c file located in texk/web2c/pdftexdir. This occurs when handling a crafted cmr10.pfb file. It is noted that the categorization of this...

Oracle Linux 7 : texlive (ELSA-2020-1036)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1036 advisory. 2:2012-45.20130427r30134 - Related: 1650521, buffer overflow in t1checkunusualcharstring function 2:2012-44.20130427r30134 - Resolves: 1650521, buffer overflow ...

openSUSE 15: libkpathsea6 / libptexenc1 / libsynctex2 / libtexlua53-5 / etc (SUSE-SU-2023:2284-2)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:2284-2 advisory. - CVE-2023-32700: Fixed arbitrary code execution in LuaTeX bsc1211389. Tenable has extracted the preceding description block directly from the SUSE security...

The vulnerability of the axodraw2 component in the TeX Live typesetting system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the axodraw2 component in the TeX Live typesetting system is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the io.popen() function in the luatex-core.lua component of LuaTeX desktop publishing systems, such as TeX Live and MiKTeX, allows a malicious actor to execute arbitrary commands.

The vulnerability of the io.popen function in the luatex-core.lua component of LuaTeX desktop publishing systems such as TeX Live and MiKTeX is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

OESA-2023-1421 texlive-base security update

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...

Oracle Linux 8 / 9 : texlive (ELSA-2023-3661)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3661 advisory. 9:20200406-26 - Resolves: 2209872, CVE-2023-32700 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. No...

texlive: arbitrary code execution allows document complied with older version

An arbitrary code execution vulnerability was found in LuaTeX TeX Live that allows any document compiled with older versions of LuaTeX to execute arbitrary shell commands, even with shell escape disabled...

[SECURITY] Fedora 37 Update: texlive-base-20210325-54.fc37

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...

Fedora 37 : texlive-base (2023-d261122726)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d261122726 advisory. Fix CVE-2023-32700 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Fedora: Security Advisory for texlive-base (FEDORA-2023-38094d905c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: texlive-base-20220321-72.fc38

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...

USN-6115-1: TeX Live vulnerability

Max Chernoff discovered that LuaTeX TeX Live did not properly disable shell escape. An attacker could possibly use this issue to execute arbitrary shell commands...

USN-6115-1 texlive-bin vulnerability

Max Chernoff discovered that LuaTeX TeX Live did not properly disable shell escape. An attacker could possibly use this issue to execute arbitrary shell commands...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : TeX Live vulnerability (USN-6115-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6115-1 advisory. Max Chernoff discovered that LuaTeX TeX Live did not properly disable shell escape. An attacker could possibly use this issue to...

SUSE SLES15: cups-filters / cups-filters-devel / libkpathsea6 / libpoppler-cpp0 / etc (SUSE-SU-2023:2287-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2287-1 advisory. cups-filters: - CVE-2023-24805: Fixed a remote code execution in the beh backend bsc1211340. texlive: - CVE-2023-3270...

Debian dla-3427 : libkpathsea-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3427 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3427-2 [email protected]...

CVE-2023-32700

An arbitrary code execution vulnerability was found in LuaTeX TeX Live that allows any document compiled with older versions of LuaTeX to execute arbitrary shell commands, even with shell escape disabled...

DEBIAN-CVE-2023-32700

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5...