安全公告详情

NS-SA-2025-0137

2025-07-25 16:49:52

简介

important: texlive-base/microcode_ctl security update

严重级别

important

主题

An update for texlive-base/microcode_ctl is now available for NewStart CGSL MAIN 7.02.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

texlive-base:
microcode_ctl:


Security Fix(es):
texlive-base: An arbitrary code execution vulnerability was found in LuaTeX (TeX Live) that allows any document compiled with older versions of LuaTeX to execute arbitrary shell commands, even with shell escape disabled.(CVE-2023-32700)
texlive-base: bugfix
microcode_ctl: A Gather Data Sampling (GDS) transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction (load from memory) to infer stale data from previously used vector registers on the same physical core.(CVE-2022-40982)
microcode_ctl: An improper access control flaw was found in some third generation Intel processors that may allow a privileged user to enable information disclosure via local access.(CVE-2023-23908)
microcode_ctl: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 7.02.03B8.

影响组件

  • texlive-base
  • microcode_ctl

影响产品

  • CGSL MAIN 7.02

更新包

{"fix":[{"product":"CGSL MAIN 7.02","pkgs":[{"binary":["texlive-xetex-svn62387-15.zncgsl7.4.x86_64.rpm","texlive-texlive.infra-svn63645-15.zncgsl7.4.noarch.rpm","texlive-texlive-scripts-svn64830-15.zncgsl7.4.noarch.rpm","texlive-pdftex-svn64690-15.zncgsl7.4.x86_64.rpm","texlive-mptopdf-svn61520-15.zncgsl7.4.noarch.rpm","texlive-metafont-svn62387-15.zncgsl7.4.x86_64.rpm","texlive-mfware-svn62387-15.zncgsl7.4.x86_64.rpm","texlive-makeindex-svn62517-15.zncgsl7.4.x86_64.rpm","texlive-luatex-svn64839-15.zncgsl7.4.x86_64.rpm","texlive-luaotfload-svn64616-15.zncgsl7.4.noarch.rpm","texlive-lib-20220321-15.zncgsl7.4.x86_64.rpm","texlive-kpathsea-svn64475-15.zncgsl7.4.x86_64.rpm","texlive-glyphlist-svn54074-15.zncgsl7.4.noarch.rpm","texlive-gsftopk-svn52851-15.zncgsl7.4.x86_64.rpm","texlive-dvipdfmx-svn61101-15.zncgsl7.4.x86_64.rpm","texlive-dvips-svn62387-15.zncgsl7.4.x86_64.rpm","texlive-epstopdf-svn64439-15.zncgsl7.4.noarch.rpm","texlive-bibtex-svn64491-15.zncgsl7.4.x86_64.rpm","texlive-base-20220321-15.zncgsl7.4.x86_64.rpm","texlive-latex-svn63825-15.zncgsl7.4.noarch.rpm"],"source":"texlive-base-20220321-15.zncgsl7.4.src.rpm"},{"binary":["microcode_ctl-20231114-1.zncgsl7.5.x86_64.rpm"],"source":"microcode_ctl-20231114-1.zncgsl7.5.src.rpm"}]}]}

CVE

参考