Bugzilla – Bug 1228218
VUL-0: CVE-2024-29073: anki: arbitrary file read through the Latex handler
Last modified: 2024-07-24 10:00:54 UTC
An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29073 https://www.cve.org/CVERecord?id=CVE-2024-29073 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992
I think I can't really help with this. I only touched the Anki package once, in 2019. Our versio is 2.1.13 from May 2019. And the current upstream version is 24.06.3 and even though the version schema changed we are A LOT of versions behind. I believe the reason for this is that a long time ago Anki changed something which made it super annoying to package it. I don't remember the details anymore but remember that I was quite annoyed at something and after my once contribution decided not to contribute anymore. I believe more distro packagers felt that way since we can see that several other distros are also quite behind in their packaging of Anki. Fedora and Debian got stuck at 2.1.15 as well. Sadly I have to recommend that people use the flatpak version of it. As for fixing these bugs I'm not sure who could do it or whether it's possible to remove Anki from 15.6 repos.. Luckily it's only in `Education` and not in Factory anymore.