DescriptionLuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs1036470

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
texlive-bin (PTS)buster2018.20181218.49446-1vulnerable
buster (security)2018.20181218.49446-1+deb10u1vulnerable
bullseye (security)2020.20200327.54578-7+deb11u1vulnerable
bookworm, sid2022.20220321.62855-5.1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[bullseye] - texlive-bin <no-dsa> (Minor issue)
[buster] - texlive-bin <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems