CVE-2023-32700

Synopsis Important: texlive security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for texlive is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 81 Update Services for SAP Solut ...

Max Chernoff discovered that improperly secured shell-escape in LuaTeX may result in arbitrary shell command execution, even with shell escape disabled, if specially crafted tex files are processed For the stable distribution (bullseye), this problem has been fixed in version 20202020032754578-7+deb11u1 We recommend that you upgrade your texliv ...

DescriptionThe MITRE CVE dictionary describes this issue as: LuaTeX before 1170 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source This occurs because luatex-corelua lets the original iopopen be accessed This also affects TeX Live before 2023 r66984 and MiKTeX before 235 ...