CVE-2023-32700

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because lua...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2023-32700 texlive-bin 修正版: 2020.20200327.54578-7+deb11u1

参照URL

advisory github.com
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory nvd.nist.gov
web github.com
web gitlab.lisn.upsaclay.fr
web tug.org
web tug.org