[Bug 1228220] New: VUL-0: CVE-2024-32152: anki: arbitrary file creation at a fixed path through the LaTeX functionality
https://bugzilla.suse.com/show_bug.cgi?id=1228220 Bug ID: 1228220 Summary: VUL-0: CVE-2024-32152: anki: arbitrary file creation at a fixed path through the LaTeX functionality Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/414903/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mvetter@suse.com Reporter: smash_bz@suse.de QA Contact: security-team@suse.de CC: camila.matos@suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32152 https://www.cve.org/CVERecord?id=CVE-2024-32152 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1994 -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1228220 SMASH SMASH <smash_bz@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1228220 https://bugzilla.suse.com/show_bug.cgi?id=1228220#c2 Michael Vetter <mvetter@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mvetter@suse.com |security-team@suse.de --- Comment #2 from Michael Vetter <mvetter@suse.com> --- I think I can't really help with this. I only touched the Anki package once, in 2019. Our versio is 2.1.13 from May 2019. And the current upstream version is 24.06.3 and even though the version schema changed we are A LOT of versions behind. I believe the reason for this is that a long time ago Anki changed something which made it super annoying to package it. I don't remember the details anymore but remember that I was quite annoyed at something and after my once contribution decided not to contribute anymore. I believe more distro packagers felt that way since we can see that several other distros are also quite behind in their packaging of Anki. Fedora and Debian got stuck at 2.1.15 as well. Sadly I have to recommend that people use the flatpak version of it. As for fixing these bugs I'm not sure who could do it or whether it's possible to remove Anki from 15.6 repos.. Luckily it's only in `Education` and not in Factory anymore. -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com