Summary
Max Chernoff discovered that LuaTeX (TeX Live) did not properly disable
shell escape. An attacker could possibly use this issue to execute
arbitrary shell commands.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | texlive-bin | 2017.20170613.44572-8ubuntu0.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | texlive-bin | 2019.20190605.51237-3ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | texlive-bin | 2021.20210626.59705-1ubuntu0.1 |
Vulnerabilities 1
-
High 8.8
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted …
References
-
report
https://ubuntu.com/security/CVE-2023-32700