| Name | CVE-2023-32668 |
| Description | LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1036470 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| texlive-bin (PTS) | buster | 2018.20181218.49446-1 | vulnerable |
| buster (security) | 2018.20181218.49446-1+deb10u2 | vulnerable |
| bullseye (security), bullseye | 2020.20200327.54578-7+deb11u1 | vulnerable |
| bookworm | 2022.20220321.62855-5.1+deb12u1 | fixed |
| trixie, sid | 2023.20230311.66589-9 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| texlive-bin | source | bookworm | 2022.20220321.62855-5.1+deb12u1 | | | |
| texlive-bin | source | (unstable) | 2022.20220321.62855-6 | | | 1036470 |
Notes
[bullseye] - texlive-bin <no-dsa> (Minor issue)
[buster] - texlive-bin <no-dsa> (Minor issue)
https://tug.org/pipermail/tex-live/2023-May/049188.html
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/b266ef076c96b382cd23a4c93204e247bb98626a
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/e7df9234420973a2f69aac1b10cbb5f00b0cda4d
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/da4492c789e25f05255d54e45447d3da79098967