PT-2017-4251 · Luatex+10 · Luatex+10

Max Chernoff · Published 2017-03-01 · Updated 2025-01-31 · CVE-2023-32700

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LuaTeX versions prior to 1.17.0 TeX Live versions prior to 2023 r66984 MiKTeX versions prior to 23.5

Description The issue is related to the io.popen() function in the luatex-core.lua component, which lacks input validation. This allows an attacker to execute arbitrary shell commands when a TeX file from an untrusted source is compiled. The vulnerability can be exploited by accessing the original io.popen through luatex-core.lua.

Recommendations For LuaTeX versions prior to 1.17.0, update to version 1.17.0 or later to resolve the issue. For TeX Live versions prior to 2023 r66984, update to version 2023 r66984 or later to resolve the issue. For MiKTeX versions prior to 23.5, update to version 23.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the io.popen() function in luatex-core.lua to minimize the risk of exploitation.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

ALSA-2023:3661

BDU:2023-03875

CESA-2023_3661

CVE-2023-32700

DLA-3427-1

DLA-3427-2

DLA-3946-1

DSA-5406-1

INFSA-2023_3661

MGASA-2023-0233

OESA-2023-1421

OPENSUSE-SU-2023_2284-2

OPENSUSE-SU-2024:12936-1

RHSA-2023:3661

RHSA-2023_3661

RLSA-2023:3661

SUSE-SU-2023:2284-1

SUSE-SU-2023:2284-2

SUSE-SU-2023:2285-1

SUSE-SU-2023:2287-1

SUSE-SU-2023_2284-1

SUSE-SU-2023_2285-1

USN-6115-1

Affected Products

Almalinux

Astra Linux

Centos

Linuxmint

Luatex

Miktex

Red Hat

Rocky Linux

Suse

Tex Live

Ubuntu

References · 64

• https://nvd.nist.gov/vuln/detail/CVE-2023-32700 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-32700 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2284-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-32700 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6115-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TF6YXUUFRGBIXIIIEV5SGBJXXT2SMUK5 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5406-1 · Vendor Advisory
• https://tug.org/~mseven/luatex.html · Vendor Advisory
• https://debian.org/security/2023/dsa-5406 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:3661 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:3661 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3427-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32700 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2285-1 · Vendor Advisory