May 20, 2023, 6:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

cve file live lua shell untrusted

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Security Engineer II, Offensive Security Penetration Testing

@ Amazon.com | US, TX, Virtual Location - Texas

Cybersecurity Specialist (Security Engineering)

@ Triton AI Pte Ltd | Singapore, Singapore, Singapore

Information Systems Security Officer (ISSO)

@ ARA | Arlington, Virginia, United States

Lead - IT Risk compliance & Info Security

@ First Advantage | Bengaluru-560042, Karnataka

Embedded VSOC Analyst

@ Sibylline Ltd | Australia, Australia