Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.6695.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6695-1)
Summary:	The remote host is missing an update for the 'texlive-bin' package(s) announced via the USN-6695-1 advisory.
Description:	Summary: The remote host is missing an update for the 'texlive-bin' package(s) announced via the USN-6695-1 advisory. Vulnerability Insight: It was discovered that TeX Live incorrectly handled certain memory operations in the embedded axodraw2 tool. An attacker could possibly use this issue to cause TeX Live to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2019-18604) It was discovered that TeX Live allowed documents to make arbitrary network requests. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could possibly use this issue to exfiltrate sensitive information, or perform other network-related attacks. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-32668) It was discovered that TeX Live incorrectly handled certain TrueType fonts. If a user or automated system were tricked into opening a specially crafted TrueType font, a remote attacker could use this issue to cause TeX Live to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-25262) Affected Software/OS: 'texlive-bin' package(s) on Ubuntu 20.04, Ubuntu 22.04, Ubuntu 23.10. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-18604 https://github.com/TeX-Live/texlive-source/commit/9216833a3888a4105a18e8c349f65b045ddb1079#diff-987e40c0e27ee43f6a2414ada73a191a https://lists.debian.org/debian-lts-announce/2023/05/msg00033.html Common Vulnerability Exposure (CVE) ID: CVE-2023-32668 https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3 https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0 https://tug.org/pipermail/tex-live/2023-May/049188.html https://tug.org/~mseven/luatex.html#luasocket Common Vulnerability Exposure (CVE) ID: CVE-2024-25262 https://bugs.launchpad.net/ubuntu/+source/texlive-bin/+bug/2047912 https://tug.org/svn/texlive/trunk/Build/source/texk/ttfdump/ChangeLog?revision=69605&view=co
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.