CVE-2023-32700
20.05.2023, 18:15
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
| Vendor | Product | Version |
|---|---|---|
| luatex_project | luatex | 1.04 ≤ 𝑥 < 1.16.2 |
| miktex | miktex | 2.9.6300 ≤ 𝑥 < 23.5 |
| tug | tex_live | 2017 ≤ 𝑥 < 2023 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| texlive-bin |
|
References