CVE-2024-25262

NameCVE-2024-25262
Descriptiontexlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3941-1, ELA-1225-1
Debian Bugs1064517

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
texlive-bin (PTS)jessie, jessie (lts)2014.20140926.35254-6+deb8u1vulnerable
stretch (security)2016.20160513.41080.dfsg-2+deb9u1vulnerable
stretch (lts), stretch2016.20160513.41080.dfsg-2+deb9u2fixed
buster, buster (lts)2018.20181218.49446-1+deb10u3fixed
buster (security)2018.20181218.49446-1+deb10u2vulnerable
bullseye2020.20200327.54578-7+deb11u1vulnerable
bullseye (security)2020.20200327.54578-7+deb11u2fixed
bookworm2022.20220321.62855-5.1+deb12u1vulnerable
sid, trixie2024.20240313.70630+ds-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
texlive-binsourcestretch2016.20160513.41080.dfsg-2+deb9u2ELA-1225-1
texlive-binsourcebuster2018.20181218.49446-1+deb10u3ELA-1225-1
texlive-binsourcebullseye2020.20200327.54578-7+deb11u2DLA-3941-1
texlive-binsource(unstable)2023.20230311.66589-91064517

Notes

[bookworm] - texlive-bin <no-dsa> (Minor issue)
[buster] - texlive-bin <no-dsa> (Minor issue)
https://tug.org/svn/texlive/trunk/Build/source/texk/ttfdump/ChangeLog?revision=69605&view=co
https://bugs.launchpad.net/ubuntu/+source/texlive-bin/+bug/2047912
https://github.com/TeX-Live/texlive-source/pull/63
[jessie] - texlive-bin <ignored> (Minor issue)

Search for package or bug name: Reporting problems