PatchTheCVEtex live vulnerabilities and fixes
Recent CVEs affecting tex live, with upgrade or downgrade steps. 2 tracked.
Also searched as: texlive.
tex live has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2023-05-20. Highest priority: CVE-2023-32700 (score 42/100).
- CVE-2023-32700 HIGH 7.8 UPGRADE UPGRADE LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u
- CVE-2023-32668 MEDIUM 5.5 UPGRADE UPGRADE LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests
FAQ
How do I fix tex live vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tex live being exploited right now?
None of the tracked tex live CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tex live CVE should I patch first?
CVE-2023-32700 currently ranks highest (42/100): LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u.