CyberSecBulletin

Tug vulnerabilities

We track 2 vulnerabilities in Tug products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on February 29, 2024.

2vulnerabilities
0critical
2high
0exploited
7.9average CVSS score

Latest Tug vulnerabilities

  • 8.1 High severity

    tex_live: Heap-based Buffer Overflow

    CVE-2024-25262Tug

    texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file.

  • 7.8 High severity

    Luatex: Improper Neutralization of Special Elements used in a Command

    CVE-2023-32700Luatex Project

    LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX