[EXT] Re: Fwd: [USN-6695-1] TeX Live vulnerabilities

[Philip Taylor (RHUoL)]

Juergen Fenn via tex-live wrote:

Thanks for the hint. I'm afraid, Thunderbird cannot read these mail
attachments.


The key part is in base-64, so can be decoded online :
==========================================================================
Ubuntu Security Notice USN-6695-1
March 14, 2024

texlive-bin vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in TeX Live.

Software Description:
- texlive-bin: Binaries for TeX Live

Details:

It was discovered that TeX Live incorrectly handled certain memory
operations in the embedded axodraw2 tool. An attacker could possibly use
this issue to cause TeX Live to crash, resulting in a denial of service.
This issue only affected Ubuntu 20.04 LTS. (CVE-2019-18604)

It was discovered that TeX Live allowed documents to make arbitrary
network requests. If a user or automated system were tricked into opening a
specially crafted document, a remote attacker could possibly use this issue
to exfiltrate sensitive information, or perform other network-related
attacks. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2023-32668)

It was discovered that TeX Live incorrectly handled certain TrueType fonts.
If a user or automated system were tricked into opening a specially crafted
TrueType font, a remote attacker could use this issue to cause TeX Live to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2024-25262)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   texlive-binaries                2023.20230311.66589-6ubuntu0.1
   texlive-binaries-sse2           2023.20230311.66589-6ubuntu0.1

Ubuntu 22.04 LTS:
   texlive-binaries                2021.20210626.59705-1ubuntu0.2

Ubuntu 20.04 LTS:
   texlive-binaries                2019.20190605.51237-3ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6695-1
   CVE-2019-18604, CVE-2023-32668, CVE-2024-25262

Package Information:
   https://launchpad.net/ubuntu/+source/texlive-bin/2023.20230311.66589-6ubuntu0.1
   https://launchpad.net/ubuntu/+source/texlive-bin/2021.20210626.59705-1ubuntu0.2
   https://launchpad.net/ubuntu/+source/texlive-bin/2019.20190605.51237-3ubuntu0.2

--
Philip Taylor

This email, its contents and any attachments are intended solely for the addressee and may contain confidential information. In certain circumstances, it may also be subject to legal privilege. Any unauthorised use, disclosure, or copying is not permitted. If you have received this email in error, please notify us and immediately and permanently delete it. Any views or opinions expressed in personal emails are solely those of the author and do not necessarily represent those of Royal Holloway, University of London. It is your responsibility to ensure that this email and any attachments are virus free.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://tug.org/pipermail/tex-live/attachments/20240314/45ddb187/attachment-0001.htm>