Skip to content
Fencer Vulns
medium 5.5

CVE-2023-32668 json

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests.

published 2023-05-11 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-36911

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Patch / fix

  • luatex_project luatex 1.17.0
  • miktex miktex 23.5
  • tug tex_live 2023
  • texlive-bin Debian 12 2022.20220321.62855-5.1+deb12u1
  • texlive-bin Debian 14, Debian 13 2022.20220321.62855-6

debian advisories DEBIAN-CVE-2023-32668

  • texlive-bin Ubuntu 20.04 LTS 2019.20190605.51237-3ubuntu0.2
  • texlive-bin Ubuntu 22.04 LTS 2021.20210626.59705-1ubuntu0.2
  • texlive-bin Ubuntu Pro 16.04 LTS 2015.20160222.37495-1ubuntu0.1+esm1
  • texlive-bin Ubuntu Pro 18.04 LTS 2017.20170613.44572-8ubuntu0.2+esm1

ubuntu advisories UBUNTU-CVE-2023-32668

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • texlive openSUSE Tumbleweed 2023.20230311.svn34398-90.1

opensuse advisories openSUSE-SU-2024:12936-1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • tug.org https://tug.org/~mseven/luatex.html#luasocket referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.