CVE-2018-17407

Name of the Vulnerable Software and Affected Versions: TeX Live versions prior to 2018-09-21

Description: An issue in the t1 check unusual charstring function allows arbitrary code execution when a malicious font is loaded by tools such as pdflatex, pdftex, dvips, or luatex. The issue is related to a buffer overflow in the handling of Type 1 fonts.

Recommendations: For TeX Live versions prior to 2018-09-21, update to a version released after 2018-09-21 to resolve the issue. As a temporary workaround, consider restricting the use of the t1 check unusual charstring function or avoiding the loading of unknown or untrusted fonts with the vulnerable tools until a patch is applied.