Vulnerability-Lookup

OESA-2026-2114 (CVE-2024-25262)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

texlive-base security update

Details

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.

Security Fix(es):

texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file.(CVE-2024-25262)

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-25262	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "texlive-afm2pl-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-aleph-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-autosp-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-axodraw2-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-base-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-base-debuginfo-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-base-debugsource-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-bibtex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-bibtex8-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-bibtexu-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-chktex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-cjkutils-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-ctie-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-cweb-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-detex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dtl-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvi2tty-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvicopy-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvidvi-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dviljk-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvipdfmx-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvipng-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvipos-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvips-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-dvisvgm-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-fontware-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-gregoriotex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-gsftopk-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-kpathsea-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-lacheck-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-lcdftypetools-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-lib-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-lib-devel-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-luatex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-m-tx-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-makeindex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-metafont-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-metapost-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-mflua-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-mfware-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-musixtnt-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-omegaware-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-patgen-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-pdftex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-pdftools-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-pmx-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-ps2pk-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-pstools-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-ptex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-seetexk-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-synctex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-tex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-tex4ht-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-texware-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-tie-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-ttfutils-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-uptex-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-velthuis-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-vlna-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-web-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-xdvi-20180414-35.oe2003sp4.aarch64.rpm",
          "texlive-xetex-20180414-35.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "texlive-a2ping-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-accfonts-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-adhocfilelist-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-amstex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-arara-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-authorindex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-bib2gls-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-bibexport-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-bundledoc-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-cachepic-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-checkcites-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-checklistings-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-context-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-convbkmk-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-crossrefware-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-cslatex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-csplain-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ctan-o-mat-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ctanify-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ctanupload-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-cyrillic-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-de-macro-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-diadia-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-dosepsbin-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-dtxgen-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-dviasm-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-dviinfox-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ebong-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-eplain-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-epspdf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-epstopdf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-exceltex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-fig4latex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-findhyph-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-fontinst-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-fontools-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-fragmaster-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-getmap-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-glossaries-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-glyphlist-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-installfont-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-jadetex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-jfmutil-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-kotex-utils-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-l3build-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latex-git-log-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latex-papersize-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latex2man-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latex2nemeth-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latexdiff-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latexfileversion-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latexindent-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-latexpand-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-lilyglyphs-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-listbib-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-listings-ext-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-lollipop-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ltxfileinfo-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ltximg-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-lua2dox-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-luaotfload-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-lwarp-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-lyluatex-svn47584-35.oe2003sp4.noarch.rpm",
          "texlive-make4ht-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-makedtx-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-match_parens-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mathspic-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mf2pt1-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mkgrkindex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mkjobtexmf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mkpic-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mltex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-mptopdf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-multibibliography-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-musixtex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-oberdiek-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pax-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pdfbook2-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pdfcrop-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pdfjam-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pdflatexpicscale-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pdfxup-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pedigree-perl-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-perltex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-petri-nets-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pfarrei-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pkfix-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pkfix-helper-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pmxchords-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pst-pdf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pst2pdf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ptex-fontmaps-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ptex2pdf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-purifyeps-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pygmentex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-pythontex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-rubik-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-splitindex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-srcredact-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-sty2dtx-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-svn-multi-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-tetex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-tex4ebook-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texconfig-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texcount-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texdef-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texdiff-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texdirflatten-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texdoc-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texdoctk-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texfot-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texlive-en-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texlive-scripts-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texlive.infra-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texliveonfly-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texloganalyser-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texosquery-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-texsis-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-thumbpdf-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-tpic2pdftex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-typeoutfileinfo-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-ulqda-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-urlbst-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-vpe-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-wordcount-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-xmltex-20180414-35.oe2003sp4.noarch.rpm",
          "texlive-yplan-20180414-35.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "texlive-base-20180414-35.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "texlive-afm2pl-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-aleph-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-autosp-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-axodraw2-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-base-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-base-debuginfo-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-base-debugsource-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-bibtex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-bibtex8-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-bibtexu-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-chktex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-cjkutils-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-ctie-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-cweb-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-detex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dtl-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvi2tty-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvicopy-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvidvi-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dviljk-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvipdfmx-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvipng-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvipos-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvips-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-dvisvgm-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-fontware-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-gregoriotex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-gsftopk-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-kpathsea-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-lacheck-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-lcdftypetools-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-lib-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-lib-devel-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-luatex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-m-tx-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-makeindex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-metafont-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-metapost-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-mflua-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-mfware-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-musixtnt-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-omegaware-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-patgen-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-pdftex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-pdftools-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-pmx-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-ps2pk-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-pstools-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-ptex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-seetexk-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-synctex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-tex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-tex4ht-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-texware-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-tie-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-ttfutils-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-uptex-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-velthuis-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-vlna-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-web-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-xdvi-20180414-35.oe2003sp4.x86_64.rpm",
          "texlive-xetex-20180414-35.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "texlive-base",
        "purl": "pkg:rpm/openEuler/texlive-base\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20180414-35.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\n\ntexlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file.(CVE-2024-25262)",
  "id": "OESA-2026-2114",
  "modified": "2026-08-06T11:11:06Z",
  "published": "2026-04-25T11:11:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2114"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25262"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "texlive-base security update",
  "upstream": [
    "CVE-2024-25262"
  ]
}

CVE-2024-25262 (GCVE-0-2024-25262)

Vulnerability from cvelistv5 – Published: 2024-02-20 00:00 – Updated: 2025-11-03 21:54

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-04 18:34 UTC

CWE

n/a
CWE-122 - Heap-based Buffer Overflow

Assigner

mitre mitre root

References

3 references

URL	Tags
https://tug.org/svn/texlive/trunk/Build/source/te…
https://bugs.launchpad.net/ubuntu/+source/texlive…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

1 product

Vendor	Product	Version
tug	tex_live	Affected: c515e cpe:2.3:a:tug:tex_live::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:54:04.024Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://tug.org/svn/texlive/trunk/Build/source/texk/ttfdump/ChangeLog?revision=69605\u0026view=co"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.launchpad.net/ubuntu/+source/texlive-bin/+bug/2047912"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:tug:tex_live:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tex_live",
            "vendor": "tug",
            "versions": [
              {
                "status": "affected",
                "version": "c515e"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-25262",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T18:34:50.731515Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-122",
                "description": "CWE-122 Heap-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T18:42:41.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-20T16:37:03.247Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://tug.org/svn/texlive/trunk/Build/source/texk/ttfdump/ChangeLog?revision=69605\u0026view=co"
        },
        {
          "url": "https://bugs.launchpad.net/ubuntu/+source/texlive-bin/+bug/2047912"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-25262",
    "datePublished": "2024-02-20T00:00:00.000Z",
    "dateReserved": "2024-02-07T00:00:00.000Z",
    "dateUpdated": "2025-11-03T21:54:04.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2026-2114 (CVE-2024-25262)

CVE-2024-25262 (GCVE-0-2024-25262)

Tags

Sightings

Nomenclature

Related by attack behaviour