CVE-2023-46051: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-46051 is a NULL pointer dereference vulnerability discovered in TeX Live version 944e257, specifically affecting the tounicode.c file in the texk/web2c/pdftexdir directory. The vulnerability was reported in August 2023 and is currently disputed as it should be categorized as a usability problem rather than a security issue (TeX Live Mail, Full Disclosure).

The vulnerability occurs in the texk/web2c/pdftexdir/tounicode.c file where under specific conditions, the undumpcharptr() macro can fail, causing gu->name to be set to NULL. This leads to a segmentation fault inside avl_probe() when the comparison function (comp_glyph_unicode_entry) attempts to call strcmp() on names, one of which is NULL. The vulnerability has been assigned a CVSS 3.1 Base Score of 3.3 (Low) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (NVD).

The impact of this vulnerability is limited to a potential denial of service through application crash when processing specially crafted files. As it is a NULL pointer dereference, it primarily affects the availability of the system but does not lead to code execution or data compromise (NVD).

The vulnerability requires local access and user interaction to exploit, as it involves processing a specially crafted file. The issue can be reproduced by placing a malformed pdflatex.fmt file in the current directory and then attempting to compile something with pdflatex (TeX Live Mail).