View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2018-17407 severity important: SUSE including 1838 source package names (libkpathsea6-6.2.0dev-22.3.1, libkpathsea6-6.2.3-11.8.4, …), 3309 product×package rows across 41 product lines (SUSE Enterprise Storage 4, SUSE Liberty Linux 7, … (41 product lines)): Fixed 3291, Known Not Affected 18.
An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.