Skip to content
OpenAdvisories
Medium · 5.5 CVE-2023-32668 EUVD-2023-36911GHSA-hm67-jh95-48xh

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full ac…

Published May 11, 2023 · Updated Nov 3, 2025 · Assigned by mitre

Package: texlive-bin Package: texlive-bin Ecosystem: Debian Ecosystem: Ubuntu

Description

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 texlive-bin 2022.20220321.62855-6 —
Debian 13 texlive-bin 2022.20220321.62855-6 —
Debian 12 texlive-bin 2022.20220321.62855-5.1+deb12u1 —
Debian 11 texlive-bin 2020.20200327.54578-7+deb11u2 DLA-3941-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS texlive-bin 2021.20210626.59705-1ubuntu0.2 USN-6695-1
Ubuntu 20.04 LTS texlive-bin 2019.20190605.51237-3ubuntu0.2 USN-6695-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS texlive-bin 2017.20170613.44572-8ubuntu0.2+esm1 —
Ubuntu Pro 16.04 LTS texlive-bin 2015.20160222.37495-1ubuntu0.1+esm1 —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed texlive 2023.20230311.svn34398-90.1 openSUSE-SU-2024:12936-1

Advisories 3

References