PatchTheCVEluatex project vulnerabilities
Recent CVEs affecting luatex project products. 2 tracked.
luatex project has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2023-05-20. Highest priority: CVE-2023-32700 (score 42/100).
- CVE-2023-32700 HIGH 7.8 UPGRADE UPGRADE LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u
- CVE-2023-32668 MEDIUM 5.5 UPGRADE UPGRADE LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests
FAQ
How do I fix luatex project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is luatex project being exploited right now?
None of the tracked luatex project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which luatex project CVE should I patch first?
CVE-2023-32700 currently ranks highest (42/100): LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u.