{"id":"CVE-2023-46048","aliases":["DEBIAN-CVE-2023-46048","EUVD-2023-50309","GHSA-j569-gjjp-9rhp","OESA-2024-1997","OESA-2024-1998","OESA-2024-1999","OESA-2024-2000","OESA-2024-2001","SUSE-SU-2024:1296-1","SUSE-SU-2024:1310-1","SUSE-SU-2026:3628-1"],"status":"disputed","title":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is...","description":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00291,"percentile":0.21768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-03-27T00:00:00Z","modified":"2026-10-26T18:02:34Z","fixes":[{"ecosystem":"openEuler:22.03-LTS-SP3","package":"texlive-base","fixed_in":["20180414-38.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"texlive-base","fixed_in":["20180414-33.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"texlive-base","fixed_in":["20180414-38.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"texlive-base","fixed_in":["20180414-38.oe2203sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"texlive","fixed_in":["2013.20130620-22.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"texlive","fixed_in":["2013.20130620-22.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"texlive","fixed_in":["2013.20130620-22.11.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.20220321.62855-5.1","2022.20220321.62855-5.1+deb12u1","2022.20220321.62855-5.1+deb12u2","2022.20220321.62855-6","2022.20220321.62855-7","2022.20220321.62855-8","2023.20230311.66589-1","2023.20230311.66589-2","2023.20230311.66589-3","2023.20230311.66589-4","2023.20230311.66589-5","2023.20230311.66589-6","2023.20230311.66589-7","2023.20230311.66589-8","2023.20230311.66589-9","2024.20240313.70630+ds-1","2024.20240313.70630+ds-2","2024.20240313.70630+ds-3","2024.20240313.70630+ds-4","2024.20240313.70630+ds-5","2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"Debian:13","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"Debian:14","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-38.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-33.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-38.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-8.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-38.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.20130620-22.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.20130620-22.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.20130620-22.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150400.31.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150400.31.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150400.31.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150600.38.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150600.38.3.1"}]}],"bundled":3}],"products":[{"vendor":"tug","product":"tex_live"}],"references":[{"url":"https://tug.org/pipermail/tex-live/2023-August/049400.html","tags":["x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/65","tags":["mailing-list","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/176819/tex-live-944e257-Null-Pointer.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46048","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j569-gjjp-9rhp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46048","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1997","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1998","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1999","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46051","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2001","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241296-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222126","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46048","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241310-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222127","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46051","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272432","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63729","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-46048","description":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"disputed","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:18:39.801Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50309","description":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:18:39Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-j569-gjjp-9rhp","title":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is...","description":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T06:30:32Z","modified":"2025-11-04T21:31:23Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:04:36.536202Z"}],"nvd":[{"id":"CVE-2023-46048","description":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"disputed","published":"2024-03-27T05:15:47.56Z","modified":"2026-06-17T06:29:56.37Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:09:10.192572Z"}],"osv":[{"id":"DEBIAN-CVE-2023-46048","description":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T05:15:47.56Z","modified":"2026-10-26T18:02:34.618023464Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-1997","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\r\n\r\nTex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.526454846Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1998","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\r\n\r\nTex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.73943979Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1999","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\r\n\r\nTex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.79128488Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2000","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\r\n\r\nTex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)\r\n\r\nTeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46051)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.800078635Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2001","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\r\n\r\nTex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.546760357Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"CVE-2023-46048","description":"Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T05:15:47Z","modified":"2026-08-18T09:41:54.360813468Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"SUSE-SU-2024:1296-1","title":"Security update for texlive","description":"This update for texlive fixes the following issues:\n\n- CVE-2023-46048: Fixed null pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126)\n","status":"published","published":"2024-04-15T16:37:47Z","modified":"2026-02-04T03:13:48.085587Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1310-1","title":"Security update for texlive","description":"This update for texlive fixes the following issues:\n\n- CVE-2023-46048: Fixed NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126)\n- CVE-2023-46051: Fixed NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127)\n","status":"published","published":"2024-04-16T10:02:49Z","modified":"2026-02-04T03:40:56.213346Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2026:3628-1","title":"Security update for texlive","description":"This update for texlive fixes the following issues:\n\n- CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126).\n- CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127).\n- CVE-2026-63729: use-after-free in synctex_parser.c in TeX Live (bsc#1272432).\n","status":"published","published":"2026-08-17T16:42:30Z","modified":"2026-08-18T09:30:06.064122252Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}