CVE-2023-32700
First published: Sat May 20 2023(Updated: )
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Luatex Project Luatex | >=1.04<1.16.2 | |
| Miktex Miktex | >=2.9.6300<23.5 | |
| Tug Tex Live | >=2017<2023 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/TeX-Live/texlive-source/releases/tag/build-svn66984
- https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLY43MIRONJSJVNBDFQHQ26MP3JIOB3H/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TF6YXUUFRGBIXIIIEV5SGBJXXT2SMUK5/
- https://tug.org/pipermail/tex-live/2023-May/049188.html
- https://tug.org/~mseven/luatex.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLY43MIRONJSJVNBDFQHQ26MP3JIOB3H/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF6YXUUFRGBIXIIIEV5SGBJXXT2SMUK5/
Frequently Asked Questions
What is CVE-2023-32700?
CVE-2023-32700 is a vulnerability in LuaTeX before version 1.17.0 that allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source.
How does CVE-2023-32700 occur?
CVE-2023-32700 occurs because the luatex-core.lua file in LuaTeX lets the original io.popen be accessed, which allows execution of arbitrary shell commands.
Which software is affected by CVE-2023-32700?
The software affected by CVE-2023-32700 includes LuaTeX, TeX Live before 2023 r66984, and MiKTeX before 23.5.
What is the severity of CVE-2023-32700?
The severity of CVE-2023-32700 is high, with a severity score of 7.8.
How do I fix CVE-2023-32700?
To fix CVE-2023-32700, update LuaTeX to version 1.17.0 or later, TeX Live to version 2023 r66984 or later, or MiKTeX to version 23.5 or later.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/luatex project
- canonical/luatex project luatex
- version/luatex project luatex/1.04
- vendor/miktex
- canonical/miktex miktex
- version/miktex miktex/2.9.6300
- vendor/tug
- canonical/tug tex live
- version/tug tex live/2017