Vulnerabilities > CVE-2023-32700

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

luatex-project

miktex

tug

NVD

Published: 2023-05-20

Updated: 2023-11-07

Summary

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Vulnerable Configurations

Part	Description	Count
Application	Luatex_Project Luatex Project Luatex 1.06.1 Luatex Project Luatex 1.06.3 Luatex Project Luatex 1.07.0 Luatex Project Luatex 1.08.0 Luatex Project Luatex 1.09.0 Luatex Project Luatex 1.09.2 Luatex Project Luatex 1.10.0 Luatex Project Luatex 1.11.1 Luatex Project Luatex 1.12.0 Luatex Project Luatex 1.13.0 Luatex Project Luatex 1.13.1 Luatex Project Luatex 1.13.2 Luatex Project Luatex 1.14.1 Luatex Project Luatex 1.15.0 Luatex Project Luatex 1.16.0	15
Application	Miktex Miktex Miktex *	1
Application	Tug TUG TEX Live 2018-09-21	1

Vulnerabilities > CVE-2023-32700 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2023-32700"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2023-32700