Tex Live vulnerabilities

2 known vulnerabilities in Tex Live from Tug. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  tex_live: Heap-based Buffer Overflow

  CVE-2024-25262Feb 29, 2024Tug

  texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file.

• 7.8 High severity

  Luatex: Improper Neutralization of Special Elements used in a Command

  CVE-2023-32700May 20, 2023Luatex Project

  LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX