Segmentation Violation in OTFCC Commit 617837b
Summary
CVE-2022-35026: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a part of the Debian ecosystem and is responsible for providing the binaries for the TeX Live distribution. It includes various tools and utilities for typesetting documents using the TeX typesetting system. The texlive-bin package is widely used by developers and users for LaTeX document preparation and processing.
Vulnerability Detail
The OTFCC commit 617837b in the texlive-bin package has been found to contain a segmentation violation. This vulnerability can be triggered by executing the otfccdump tool, leading to a crash or unexpected behavior. The segmentation violation occurs at the memory address 0x4fbc0b. An attacker with access to the affected system could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump tool until the texlive-bin package is updated with the fix. This can help mitigate the risk of exploitation. Alternatively, users can consider using alternative tools or methods for their document typesetting needs.
Conclusion
In conclusion, the OTFCC commit 617837b in the texlive-bin package contains a segmentation violation vulnerability that can lead to crashes, unexpected behavior, and potential code execution or denial of service. Users are advised to update their texlive-bin package to the latest version provided by the Debian repositories or trusted sources. Avoiding the use of the otfccdump tool or considering alternative methods can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
The vulnerability can lead to a crash or unexpected behavior when executing the otfccdump tool. It could also potentially allow an attacker to execute arbitrary code or cause a denial of service.
Users of the texlive-bin package in the Debian ecosystem, specifically those who utilize the otfccdump tool, are affected by this vulnerability.
At the time of this report, there is no known public exploit for this vulnerability. However, it is still important to apply the recommended fixes to prevent any potential exploitation.
All versions of the texlive-bin package prior to the one that includes the fix for this vulnerability are considered vulnerable.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
