Luatex

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2023-32700 May 20, 18:15 HIGH PATCH This Week

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.

Command Injection Tex Live Luatex Miktex Tug

NVD GitHub

CVSS 3.1

7.8

EPSS

0.8%

CVE-2023-32668 May 11, 06:15 MEDIUM POC PATCH This Month

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Tex Live Luatex Miktex Tug

NVD

CVSS 3.1

5.5

EPSS

0.4%

CVE-2023-32700

EPSS 1% CVSS 7.8

HIGH PATCH This Week

Command Injection Tex Live Luatex +2

NVD GitHub

CVE-2023-32668

EPSS 0% CVSS 5.5

MEDIUM POC PATCH This Month

Information Disclosure Tex Live Luatex +2

NVD