{"id":"CVE-2023-32668","aliases":["DEBIAN-CVE-2023-32668","DLA-3941-1","EUVD-2023-36911","GHSA-hm67-jh95-48xh","MGASA-2024-0108","OESA-2025-2694","UBUNTU-CVE-2023-32668","USN-6695-1","openSUSE-SU-2024:12936-1"],"status":"published","title":"LuaTeX before 1.17.0 enables the socket library by default.","description":"LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0037,"percentile":0.31212,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-05-11T00:00:00Z","modified":"2026-11-03T02:45:26Z","fixes":[{"ecosystem":"Debian:12","package":"texlive-bin","fixed_in":["2022.20220321.62855-5.1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"texlive-bin","fixed_in":["2022.20220321.62855-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"texlive-bin","fixed_in":["2022.20220321.62855-6"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"texlive-base","fixed_in":["20210325-12.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"texlive-base","fixed_in":["20180414-34.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"texlive-base","fixed_in":["20180414-39.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"texlive-base","fixed_in":["20180414-39.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"texlive-base","fixed_in":["20210325-12.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"texlive-base","fixed_in":["20210325-12.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"texlive-bin","fixed_in":["2015.20160222.37495-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texlive-bin","fixed_in":["2017.20170613.44572-8ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"texlive-bin","fixed_in":["2019.20190605.51237-3ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"texlive-bin","fixed_in":["2021.20210626.59705-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.20220321.62855-5.1+deb12u1"}]}],"versions":["2022.20220321.62855-5.1"]},{"source":"osv","ecosystem":"Debian:13","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.20220321.62855-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.20220321.62855-6"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.20200327.54578-7+deb11u2"}]}],"versions":["2020.20200327.54578-7","2020.20200327.54578-7+deb11u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220321-7.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-12.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-34.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-39.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-39.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-12.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-12.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.20160222.37495-1ubuntu0.1+esm1"}]}],"versions":["2015.20150524.37493-5build1","2015.20150524.37493-7","2015.20150524.37493-7build1","2015.20150524.37493-7build4","2015.20160222.37495-1","2015.20160222.37495-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017.20170613.44572-8ubuntu0.2+esm1"}]}],"versions":["2017.20170613.44572-5build1","2017.20170613.44572-5build2","2017.20170613.44572-6","2017.20170613.44572-6build1","2017.20170613.44572-6ubuntu1","2017.20170613.44572-8build1","2017.20170613.44572-8ubuntu0.1","2017.20170613.44572-8ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.20190605.51237-3ubuntu0.2"}]}],"versions":["2019.20190605.51237-2build1","2019.20190605.51237-3","2019.20190605.51237-3build1","2019.20190605.51237-3build2","2019.20190605.51237-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210626.59705-1ubuntu0.2"}]}],"versions":["2020.20200327.54578-7","2020.20200327.54578-7build1","2021.20210626.59705-1","2021.20210626.59705-1build1","2021.20210626.59705-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.20190605.51237-3ubuntu0.2"}]}],"versions":["2019.20190605.51237-2build1","2019.20190605.51237-3","2019.20190605.51237-3build1","2019.20190605.51237-3build2","2019.20190605.51237-3ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210626.59705-1ubuntu0.2"}]}],"versions":["2020.20200327.54578-7","2020.20200327.54578-7build1","2021.20210626.59705-1","2021.20210626.59705-1build1","2021.20210626.59705-1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.20230311.svn34398-90.1"}]}],"bundled":2}],"products":[{"vendor":"luatex_project","product":"luatex"},{"vendor":"miktex","product":"miktex"},{"vendor":"tug","product":"tex_live"}],"references":[{"url":"https://tug.org/pipermail/tex-live/2023-May/049188.html","tags":["x_transferred","Issue Tracking","Mailing List","Mitigation","web","report"]},{"url":"https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0","tags":["x_transferred","Patch","web","report"]},{"url":"https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://tug.org/~mseven/luatex.html#luasocket","tags":["x_transferred","Exploit","Vendor Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00032.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32668","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hm67-jh95-48xh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32668.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-32668","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0108.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32971","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6695-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2694","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-32668","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32668","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7985-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-25262","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32700","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-32668","description":"LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.","status":"published","published":"2023-05-11T00:00:00Z","modified":"2025-11-03T21:48:34.498Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-36911","description":"LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.","status":"published","published":"2023-05-11T00:00:00Z","modified":"2025-11-03T21:48:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-hm67-jh95-48xh","title":"LuaTeX before 1.17.0 enables the socket library by default.","description":"LuaTeX before 1.17.0 enables the socket library by default.","status":"published","published":"2023-05-11T06:30:21Z","modified":"2025-11-04T00:31:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:04:28.99549Z"}],"nvd":[{"id":"CVE-2023-32668","description":"LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.","status":"published","published":"2023-05-11T06:15:10Z","modified":"2026-06-17T05:59:20.827Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:08:02.399327Z"}],"osv":[{"id":"CVE-2023-32668","description":"LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.","status":"published","published":"2023-05-11T00:00:00Z","modified":"2026-11-03T02:45:26.625974408Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:05:43.703218Z"},{"id":"DEBIAN-CVE-2023-32668","description":"LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.","status":"published","published":"2023-05-11T06:15:10Z","modified":"2026-10-26T18:03:05.067790499Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2025-2694","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\n\nLuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.(CVE-2023-32668)","status":"published","published":"2025-11-22T11:09:49Z","modified":"2026-08-18T01:19:20.360314909Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2023-32668","description":"LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.","status":"published","published":"2023-05-11T06:15:00Z","modified":"2026-04-22T14:07:36.808021Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"DLA-3941-1","title":"texlive-bin - security update","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-03-09T01:23:00.927737Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0108","title":"Updated texlive-20220321 packages fix security vulnerabilities","description":"LuaTeX before 1.17.0 allows a document (compiled with the default\nsettings) to make arbitrary network requests. This occurs because full\naccess to the socket library is permitted by default, as stated in the\ndocumentation. This also affects TeX Live before 2023 r66984 and MiKTeX\nbefore 23.5. (CVE-2023-32668)\ntexlive-bin commit c515e was discovered to contain heap buffer overflow\nvia the function ttfLoadHDMX:ttfdump. This vulnerability allows\nattackers to cause a Denial of Service (DoS) via supplying a crafted TTF\nfile. (CVE-2024-25262)\n","status":"published","published":"2024-04-05T18:24:25Z","modified":"2026-04-16T04:43:14.775441598Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:12936-1","title":"libkpathsea6-6.3.5-90.1 on GA media","description":"These are all security issues fixed in the libkpathsea6-6.3.5-90.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:16.639497Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"USN-6695-1","title":"texlive-bin vulnerabilities","description":"It was discovered that TeX Live incorrectly handled certain memory\noperations in the embedded axodraw2 tool. An attacker could possibly use\nthis issue to cause TeX Live to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 20.04 LTS. (CVE-2019-18604)\n\nIt was discovered that TeX Live allowed documents to make arbitrary\nnetwork requests. If a user or automated system were tricked into opening a\nspecially crafted document, a remote attacker could possibly use this issue\nto exfiltrate sensitive information, or perform other network-related\nattacks. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2023-32668)\n\nIt was discovered that TeX Live incorrectly handled certain TrueType fonts.\nIf a user or automated system were tricked into opening a specially crafted\nTrueType font, a remote attacker could use this issue to cause TeX Live to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2024-25262)\n","status":"published","published":"2024-03-14T11:45:28Z","modified":"2026-04-22T10:45:10.147302Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}