p PatchFirst

CVE-2018-17407

CVE-2018-17407

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.

CVSS 7.8 · High · EPSS 2.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • texlive-bin Debian:12

    Affected ranges
    • ECOSYSTEM: < 2018.20180907.48586-2

    Update to 2018.20180907.48586-2

  • texlive-bin Debian:13

    Affected ranges
    • ECOSYSTEM: < 2018.20180907.48586-2

    Update to 2018.20180907.48586-2

  • texlive-bin Debian:14

    Affected ranges
    • ECOSYSTEM: < 2018.20180907.48586-2

    Update to 2018.20180907.48586-2

  • texlive-bin Ubuntu:14.04:LTS

    Versions
    • 2013.20130529.30792-1build2
    • 2013.20130729.30972-2
    • 2013.20130729.30972-2build1
    • 2013.20130729.30972-2build2
    • 2013.20130729.30972-2build3
    Affected ranges
    • ECOSYSTEM: < 2013.20130729.30972-2ubuntu0.1

    Update to 2013.20130729.30972-2ubuntu0.1

  • texlive-bin Ubuntu:16.04:LTS

    Versions
    • 2015.20150524.37493-5build1
    • 2015.20150524.37493-7
    • 2015.20150524.37493-7build1
    • 2015.20150524.37493-7build4
    • 2015.20160222.37495-1
    Affected ranges
    • ECOSYSTEM: < 2015.20160222.37495-1ubuntu0.1

    Update to 2015.20160222.37495-1ubuntu0.1

  • texlive-bin Ubuntu:18.04:LTS

    Versions
    • 2017.20170613.44572-5build1
    • 2017.20170613.44572-5build2
    • 2017.20170613.44572-6
    • 2017.20170613.44572-6build1
    • 2017.20170613.44572-6ubuntu1
    • 2017.20170613.44572-8build1
    Affected ranges
    • ECOSYSTEM: < 2017.20170613.44572-8ubuntu0.1

    Update to 2017.20170613.44572-8ubuntu0.1

Original sources

Check your server →