Segmentation Violation in OTFCC Commit 617837b
Summary
CVE-2022-35027: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a part of the Debian ecosystem and is used for typesetting documents. It provides a collection of command-line tools for working with TeX and LaTeX files. The package includes otfccdump, a tool for extracting font data from OpenType fonts. This vulnerability affects texlive-bin in Debian versions 12 and 13.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35027, is a segmentation violation that occurs in OTFCC commit 617837b. This violation can be triggered when using the otfccdump tool. An attacker could exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code. The severity of this vulnerability is rated as unimportant.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official patch or update the texlive-bin package to mitigate the risk.
Conclusion
In conclusion, the OTFCC commit 617837b in the texlive-bin package has a segmentation violation vulnerability. It is important to update the texlive-bin package to a patched version as soon as it becomes available. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
Texlive-bin is a package in the Debian ecosystem that provides command-line tools for working with TeX and LaTeX files.
Otfccdump is a tool included in the texlive-bin package that allows extraction of font data from OpenType fonts.
A segmentation violation, also known as a segmentation fault, is an error that occurs when a program tries to access a memory location that it is not allowed to access.
This vulnerability could lead to a denial-of-service condition or allow an attacker to execute arbitrary code on the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if you are affected.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
