CVE-2023-32668

NameCVE-2023-32668
DescriptionLuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3941-1, ELA-1225-1
Debian Bugs1036470

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
texlive-bin (PTS)jessie, jessie (lts)2014.20140926.35254-6+deb8u1vulnerable
stretch (security)2016.20160513.41080.dfsg-2+deb9u1vulnerable
stretch (lts), stretch2016.20160513.41080.dfsg-2+deb9u2fixed
buster, buster (lts)2018.20181218.49446-1+deb10u3fixed
buster (security)2018.20181218.49446-1+deb10u2vulnerable
bullseye2020.20200327.54578-7+deb11u1vulnerable
bullseye (security)2020.20200327.54578-7+deb11u2fixed
bookworm2022.20220321.62855-5.1+deb12u1fixed
trixie2024.20240313.70630+ds-4fixed
sid2024.20240313.70630+ds-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
texlive-binsourcestretch2016.20160513.41080.dfsg-2+deb9u2ELA-1225-1
texlive-binsourcebuster2018.20181218.49446-1+deb10u3ELA-1225-1
texlive-binsourcebullseye2020.20200327.54578-7+deb11u2DLA-3941-1
texlive-binsourcebookworm2022.20220321.62855-5.1+deb12u1
texlive-binsource(unstable)2022.20220321.62855-61036470

Notes

[buster] - texlive-bin <no-dsa> (Minor issue)
https://tug.org/pipermail/tex-live/2023-May/049188.html
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/b266ef076c96b382cd23a4c93204e247bb98626a
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/e7df9234420973a2f69aac1b10cbb5f00b0cda4d
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/da4492c789e25f05255d54e45447d3da79098967
https://www.maxchernoff.ca/p/luatex-vulnerabilities#luasocket
[jessie] - texlive-bin <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems