Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-29073

Good to know:

icon

Date: July 22, 2024

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.

Severity Score

Related Resources (9)

https://github.com/ankitects/anki/pull/3218
https://github.com/ankitects/anki/commit/06f7aa393d21d7d5dd8039e15d543b73c3346932
https://skerritt.blog/anki-0day
https://skii.dev/anki-0day
https://nvd.nist.gov/vuln/detail/CVE-2024-29073
https://security-tracker.debian.org/tracker/CVE-2024-29073
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992
https://github.com/ankitects/anki
https://www.mend.io/vulnerability-database/CVE-2024-29073

Severity Score

Weakness Type (CWE)

Inclusion of Functionality from Untrusted Control Sphere

CWE-829

Top Fix

icon

Upgrade Version

Upgrade to version anki - 24.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us