Bug 32971 - texlive new security issues CVE-2024-25262 and CVE-2023-32668
Summary: texlive new security issues CVE-2024-25262 and CVE-2023-32668
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-03-15 10:35 CET by Nicolas Salguero
Modified: 2024-04-05 20:25 CEST (History)
3 users (show)

See Also:
Source RPM: texlive-20220321-7.mga9.src.rpm
CVE: CVE-2024-25262, CVE-2023-32668
Status comment:


Attachments

Description Nicolas Salguero 2024-03-15 10:35:33 CET
Ubuntu has issued an advisory on March 14:
https://ubuntu.com/security/notices/USN-6695-1

Mageia 9 is also affected.
Nicolas Salguero 2024-03-15 10:36:19 CET

Source RPM: (none) => texlive-20220321-9.mga10.src.rpm
CVE: (none) => CVE-2024-25262, CVE-2023-32668
Whiteboard: (none) => MGA9TOO
Status comment: (none) => pa

Nicolas Salguero 2024-03-15 10:36:40 CET

Status comment: pa => Patches available from upstream and Ubuntu

Comment 1 Lewis Smith 2024-03-15 21:50:14 CET
Cannot see anything about patches on the project site.

32668 refers to these patches:
Patches:
upstream: https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/b266ef076c96b382cd23a4c93204e247bb98626a
upstream: https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/e7df9234420973a2f69aac1b10cbb5f00b0cda4d
upstream: https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/da4492c789e25f05255d54e45447d3da79098967

25262 to this one:
Patches:
upstream: https://github.com/TeX-Live/texlive-source/pull/63

Marc looks to be the principle packager for Texlive, so assigning to you. Re-assign it if you see fit.

Assignee: bugsquad => mageia

Comment 2 Nicolas Salguero 2024-04-03 16:27:38 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32668)

texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file. (CVE-2024-25262)

References:
https://ubuntu.com/security/notices/USN-6695-1
========================

Updated packages in core/updates_testing:
========================
lib(64)kpathsea6-20220321-7.1.mga9
lib(64)kpathsea-devel-20220321-7.1.mga9
lib(64)ptexenc1-20220321-7.1.mga9
lib(64)ptexenc-devel-20220321-7.1.mga9
lib(64)synctex2-20220321-7.1.mga9
lib(64)synctex-devel-20220321-7.1.mga9
lib(64)texlua5-20220321-7.1.mga9
lib(64)texlua-devel-20220321-7.1.mga9
texlive-20220321-7.1.mga9

from SRPM:
texlive-20220321-7.1.mga9.src.rpm

Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
Source RPM: texlive-20220321-9.mga10.src.rpm => texlive-20220321-7.mga9.src.rpm
Status: NEW => ASSIGNED
Assignee: mageia => qa-bugs
Status comment: Patches available from upstream and Ubuntu => (none)

katnatek 2024-04-03 20:09:48 CEST

Keywords: (none) => advisory

Comment 3 Herman Viaene 2024-04-04 17:56:37 CEST
MGA9-64 Plasma Wayland on HP-Pavillion
N onistallation issues.
Used test file from bug 23655  and followed test from bug 31952. Run into the same problem. Installing additional texlive-dist package plus its dependencies ant then
$ luatex refcard.tex refcard.pdf
This is LuaTeX, Version 1.15.0 (TeX Live 2022/Mageia) 
 restricted system commands enabled.
(./refcard.tex [1 column per page] [1{/usr/share/texmf-dist/fonts/map/pdftex/up
dmap/pdftex.map}] [2] [3] [4] [5] [6])</usr/share/texmf-dist/fonts/type1/public
/amsfonts/cm/cmbx10.pfb></usr/share/texmf-dist/fonts/type1/public/amsfonts/cm/c
mmi10.pfb></usr/share/texmf-dist/fonts/type1/public/amsfonts/cm/cmr10.pfb></usr
/share/texmf-dist/fonts/type1/public/amsfonts/cm/cmr7.pfb></usr/share/texmf-dis
t/fonts/type1/public/amsfonts/cm/cmsy7.pfb></usr/share/texmf-dist/fonts/type1/p
ublic/amsfonts/cm/cmti10.pfb></usr/share/texmf-dist/fonts/type1/public/amsfonts
/cm/cmtt10.pfb>
Output written on refcard.pdf (6 pages, 113049 bytes).
Transcript written on refcard.log.
Checked the resulting pdf, looks good.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2024-04-04 22:35:27 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 5 Mageia Robot 2024-04-05 20:25:35 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0108.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.