PatchTheCVEtug vulnerabilities
Recent CVEs affecting tug products. 2 tracked.
tug has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2023-05-20. Highest priority: CVE-2023-32700 (score 42/100).
- CVE-2023-32700 HIGH 7.8 UPGRADE UPGRADE LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u
- CVE-2023-32668 MEDIUM 5.5 UPGRADE UPGRADE LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests
FAQ
How do I fix tug vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tug being exploited right now?
None of the tracked tug CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tug CVE should I patch first?
CVE-2023-32700 currently ranks highest (42/100): LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u.