Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: texlive-base (UTSA-2023-002148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002148 advisory. LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua le...

Astra Linux – Vulnerability in TeXeVe-Bin

LuaTeX prior to version 1.17.0 allowed the execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because the luatex-core.lua file allows access to the io.popen function. This issue also affects TeX Live prior to version 2023 r66984 and MiKT...

Astra Linux – Vulnerability in TeXeVe-Bin

It was discovered that texlive-bin commit c515e contains a heap buffer overflow vulnerability through the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service DoS by providing a malicious TTF file...

Security update for texlive

This update for texlive fixes the following issue: CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution when malformed .synctex or .synctex.gz files are processedbsc1272432. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:3924-1 Security update for texlive

This update for texlive fixes the following issue: - CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution when malformed .synctex or .synctex.gz files are processedbsc1272432...

Unity Linux 20.1070e Security Update: texlive-base (UTSA-2026-104941)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104941 advisory. The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that...

Security update for evince

This update for evince fixes the following issue: CVE-2026-63729: texlive: heap use-after-free in synctexparser.c via a malformed .synctex or .synctex.gz file bsc1272433. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...

Astra Linux – Vulnerability in TeXeVe-Bin

OpenDetex 2.8.5 has a Buffer Overflow issue in TexOpen, specifically in detex.l, due to an incorrect sprintf operation...

Security update for texlive

This update for texlive fixes the following issues: CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c bsc1222126. CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c bsc1222127. CVE-2026-63729: use-after-free in synctexparser.c in TeX Live...

SUSE-SU-2026:3628-1 Security update for texlive

This update for texlive fixes the following issues: - CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c bsc1222126. - CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c bsc1222127. - CVE-2026-63729: use-after-free in synctexparser.c in TeX Live...

OESA-2026-2112 texlive-base security update

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...

OESA-2026-2113 texlive-base security update

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...

OESA-2026-2114 texlive-base security update

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...

PYSEC-2026-2184

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaT...

CVE-2026-33046

CVE-2026-33046 affects Indico (event management system) where, in versions prior to 3.3.12, TeXLive/LaTeX sanitizer bypass via specially crafted LaTeX snippets could read local files or execute code with server user privileges when server-side LaTeX rendering is enabled (XELATEX_PATH set). If ser...

Ubuntu: Security Advisory (USN-7985-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MiracleLinux 9 : texlive-20200406-26.el9 (AXSA:2023-6081:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6081:02 advisory. texlive: arbitrary code execution allows document complied with older version CVE-2023-32700 Tenable has extracted the preceding description block directly...

MiracleLinux 7 : texlive-2012-45.20130427_r30134.el7 (AXSA:2020-4564:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-4564:01 advisory. texlive: Buffer overflow in t1checkunusualcharstring function in writet1.c CVE-2018-17407 Tenable has extracted the preceding description block directly from...

MiracleLinux 8 : texlive-20180414-29.el8 (AXSA:2023-6183:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6183:03 advisory. texlive: arbitrary code execution allows document complied with older version CVE-2023-32700 Tenable has extracted the preceding description block directly...

MiracleLinux 4 : texlive-2007-57.AXS4 (AXSA:2012-203:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-203:01 advisory. TeXLive is an implementation of TeX for Linux or UNIX systems. TeX takes a text file and a set of formatting commands as input and creates a printabl...