Mageia alert MGASA-2024-0108 (texlive-20220321)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2024-0108: Updated texlive-20220321 packages fix security vulnerabilities
Date:
             
 
Fri, 05 Apr 2024 20:25:26 +0200
Message-ID:
             
 
<20240405182526.57D38A00E0@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2024-0108 - Updated texlive-20220321 packages fix security vulnerabilities

Publication date: 05 Apr 2024
URL: https://advisories.mageia.org/MGASA-2024-0108.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-25262,
     CVE-2023-32668

Description:
LuaTeX before 1.17.0 allows a document (compiled with the default
settings) to make arbitrary network requests. This occurs because full
access to the socket library is permitted by default, as stated in the
documentation. This also affects TeX Live before 2023 r66984 and MiKTeX
before 23.5. (CVE-2023-32668)
texlive-bin commit c515e was discovered to contain heap buffer overflow
via the function ttfLoadHDMX:ttfdump. This vulnerability allows
attackers to cause a Denial of Service (DoS) via supplying a crafted TTF
file. (CVE-2024-25262)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32971
- https://ubuntu.com/security/notices/USN-6695-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3...

SRPMS:
- 9/core/texlive-20220321-7.1.mga9