Skip to content
Fencer Vulns
high 8.8

CVE-2023-32700 json

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source.

published 2023-05-20 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-36927

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Patch / fix

  • luatex_project luatex 1.16.2
  • miktex miktex 23.5
  • tug tex_live 2023
  • texlive-bin Debian 14, Debian 13, Debian 12 2022.20220321.62855-5.1

debian advisories DEBIAN-CVE-2023-32700

  • texlive-bin Ubuntu 18.04 LTS 2017.20170613.44572-8ubuntu0.2
  • texlive-bin Ubuntu 20.04 LTS 2019.20190605.51237-3ubuntu0.1
  • texlive-bin Ubuntu 22.04 LTS 2021.20210626.59705-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2023-32700

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • texlive RHEL 8 7:20180414-29.el8_8
  • texlive RHEL 9 9:20200406-26.el9_2
  • texlive-ae RHEL 8 7:20180414-29.el8_8
  • texlive RHEL 8.1 E4S 7:20180414-15.el8_1
  • texlive RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 7:20180414-15.el8_2
  • texlive RHEL 8.4 TUS, RHEL 8.4 E4S, RHEL 8.4 AUS 7:20180414-21.el8_4
  • texlive RHEL 8.6 EUS 7:20180414-26.el8_6
  • texlive RHEL 9.0 EUS 9:20200406-26.el9_0

red hat advisories RHSA-2023:3661

  • texlive SLE Module for Desktop Applications 15 SP5, SLE Module for Desktop Applications 15 SP4, SLE Module for Basesystem 15 SP5 +3 more 2021.20210325-150400.31.3.1
  • poppler SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS +1 more 0.62.0-150000.4.12.1
  • texlive SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +8 more 2017.20170520-150200.21.4.1
  • texlive SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 2017.20170520-150000.11.20.1
  • cups-filters SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 1.20.3-150000.3.10.1

suse advisories SUSE-SU-2023:2284-2SUSE-SU-2023:2287-1SUSE-SU-2023:2285-1SUSE-SU-2023:2284-1

  • texlive openSUSE Tumbleweed 2023.20230311.svn34398-90.1

opensuse advisories openSUSE-SU-2024:12936-1

  • texlive AlmaLinux 9 9:20200406-26.el9_2
  • texlive-ae AlmaLinux 9 9:20200406-26.el9_2
  • texlive-cm AlmaLinux 9 9:20200406-26.el9_2
  • texlive-ec AlmaLinux 9 9:20200406-26.el9_2
  • texlive-fp AlmaLinux 9 9:20200406-26.el9_2
  • texlive-lm AlmaLinux 9 9:20200406-26.el9_2
  • texlive-ms AlmaLinux 9 9:20200406-26.el9_2
  • texlive-t2 AlmaLinux 9 9:20200406-26.el9_2

almalinux advisories ALSA-2023:3661

  • texlive Rocky Linux 9 9:20200406-26.el9_2

rocky linux advisories RLSA-2023:3661

  • texlive Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 20230506.66984-r0

alpine advisories ALPINE-CVE-2023-32700

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-32700 updated cvss 7.8

texlive: arbitrary code execution allows document complied with older version

  • Red Hat Enterprise Linux 7 texlive, texlive-ae, texlive-cm, texlive-ec, texlive-fp, texlive-lm, +304 more
    affected: no fix available
  • Red Hat CodeReady Linux Builder EUS (v.8.6) texlive 20180414-26.el8_6, texlive-ae 20180414-26.el8_6, texlive-cm 20180414-26.el8_6, texlive-ec 20180414-26.el8_6, texlive-fp 20180414-26.el8_6, texlive-lm 20180414-26.el8_6, +310 more Red Hat CodeReady Linux Builder EUS (v.9.0) texlive 20200406-26.el9_0, texlive-ae 20200406-26.el9_0, texlive-cm 20200406-26.el9_0, texlive-ec 20200406-26.el9_0, texlive-fp 20200406-26.el9_0, texlive-lm 20200406-26.el9_0, +363 more Red Hat Enterprise Linux AppStream (v. 8) texlive 20180414-29.el8_8, texlive-ae 20180414-29.el8_8, texlive-cm 20180414-29.el8_8, texlive-ec 20180414-29.el8_8, texlive-fp 20180414-29.el8_8, texlive-lm 20180414-29.el8_8, +311 more Red Hat Enterprise Linux AppStream (v. 9) texlive 20200406-26.el9_2, texlive-ae 20200406-26.el9_2, texlive-cm 20200406-26.el9_2, texlive-ec 20200406-26.el9_2, texlive-fp 20200406-26.el9_2, texlive-lm 20200406-26.el9_2, +363 more Red Hat Enterprise Linux AppStream AUS (v. 8.2) texlive 20180414-15.el8_2, texlive-ae 20180414-15.el8_2, texlive-cm 20180414-15.el8_2, texlive-ec 20180414-15.el8_2, texlive-fp 20180414-15.el8_2, texlive-lm 20180414-15.el8_2, +307 more Red Hat Enterprise Linux AppStream AUS (v.8.4) texlive 20180414-21.el8_4, texlive-ae 20180414-21.el8_4, texlive-cm 20180414-21.el8_4, texlive-ec 20180414-21.el8_4, texlive-fp 20180414-21.el8_4, texlive-lm 20180414-21.el8_4, +310 more
    +9 more products
    Red Hat Enterprise Linux AppStream E4S (v. 8.1) texlive 20180414-15.el8_1, texlive-ae 20180414-15.el8_1, texlive-cm 20180414-15.el8_1, texlive-ec 20180414-15.el8_1, texlive-fp 20180414-15.el8_1, texlive-lm 20180414-15.el8_1, +307 more Red Hat Enterprise Linux AppStream E4S (v. 8.2) texlive 20180414-15.el8_2, texlive-ae 20180414-15.el8_2, texlive-cm 20180414-15.el8_2, texlive-ec 20180414-15.el8_2, texlive-fp 20180414-15.el8_2, texlive-lm 20180414-15.el8_2, +307 more Red Hat Enterprise Linux AppStream E4S (v.8.4) texlive 20180414-21.el8_4, texlive-ae 20180414-21.el8_4, texlive-cm 20180414-21.el8_4, texlive-ec 20180414-21.el8_4, texlive-fp 20180414-21.el8_4, texlive-lm 20180414-21.el8_4, +310 more Red Hat Enterprise Linux AppStream EUS (v.8.6) texlive 20180414-26.el8_6, texlive-ae 20180414-26.el8_6, texlive-cm 20180414-26.el8_6, texlive-ec 20180414-26.el8_6, texlive-fp 20180414-26.el8_6, texlive-lm 20180414-26.el8_6, +310 more Red Hat Enterprise Linux AppStream EUS (v.9.0) texlive 20200406-26.el9_0, texlive-ae 20200406-26.el9_0, texlive-cm 20200406-26.el9_0, texlive-ec 20200406-26.el9_0, texlive-fp 20200406-26.el9_0, texlive-lm 20200406-26.el9_0, +363 more Red Hat Enterprise Linux AppStream TUS (v. 8.2) texlive 20180414-15.el8_2, texlive-ae 20180414-15.el8_2, texlive-cm 20180414-15.el8_2, texlive-ec 20180414-15.el8_2, texlive-fp 20180414-15.el8_2, texlive-lm 20180414-15.el8_2, +307 more Red Hat Enterprise Linux AppStream TUS (v.8.4) texlive 20180414-21.el8_4, texlive-ae 20180414-21.el8_4, texlive-cm 20180414-21.el8_4, texlive-ec 20180414-21.el8_4, texlive-fp 20180414-21.el8_4, texlive-lm 20180414-21.el8_4, +310 more Red Hat Enterprise Linux CRB (v. 8) texlive 20180414-29.el8_8, texlive-ae 20180414-29.el8_8, texlive-cm 20180414-29.el8_8, texlive-ec 20180414-29.el8_8, texlive-fp 20180414-29.el8_8, texlive-lm 20180414-29.el8_8, +311 more Red Hat Enterprise Linux CRB (v. 9) texlive 20200406-26.el9_2, texlive-ae 20200406-26.el9_2, texlive-cm 20200406-26.el9_2, texlive-ec 20200406-26.el9_2, texlive-fp 20200406-26.el9_2, texlive-lm 20200406-26.el9_2, +363 more
    fixed: vendor fix RHSA-2023:3661

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.