CVE-2023-32700

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.

Security Fix(es):

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.(CVE-2023-32700)

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems.

Security Fix(es):

• texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Any document compiled with older versions of LuaTeX can execute arbitrary shell commands, even with shell escape disabled. (CVE-2023-32700)

These are all security issues fixed in the libkpathsea6-6.3.5-90.1 package on the GA media of openSUSE Tumbleweed.

The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems.

Security Fix(es):

• texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for texlive fixes the following issues:

• CVE-2023-32700: Fixed arbitrary code execution in LuaTeX (bsc#1211389).

This update for texlive fixes the following issues:

• CVE-2023-32700: Fixed arbitrary code execution in LuaTeX (bsc#1211389).

This update for texlive fixes the following issues:

• CVE-2023-32700: Fixed arbitrary code execution in LuaTeX (bsc#1211389).

This update for cups-filters, poppler, texlive fixes the following issues:

cups-filters:

• CVE-2023-24805: Fixed a remote code execution in the beh backend (bsc#1211340).

texlive:

• CVE-2023-32700: Fixed arbitrary code execution in LuaTeX (bsc#1211389).

poppler:

• Added missing header file goo/GooCheckedOps.h. Without it, other packages using poppler as a library might fail to compile since our public headers now depend on it. (bsc#1211450)

Max Chernoff discovered that LuaTeX (TeX Live) did not properly disable shell escape. An attacker could possibly use this issue to execute arbitrary shell commands.