Segmentation Violation in OTFCC Commit 617837b
Summary
CVE-2022-35030: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package, specifically the Debian:12 and Debian:13 ecosystems, is affected by a vulnerability identified as CVE-2022-35030. This package is part of the TeX Live distribution and provides various binaries for TeX-related tasks. The vulnerability arises from a segmentation violation in the OTFCC commit 617837b, specifically in the otfccdump component. OTFCC is a command-line tool for manipulating OpenType fonts. The vulnerability can be triggered by executing the otfccdump binary with certain inputs.
Vulnerability Detail
The segmentation violation in OTFCC commit 617837b can lead to a crash or unexpected behavior when executing the otfccdump binary. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition, potentially affecting the availability of the system. The exact technical details of the vulnerability are not provided in the available information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround is mentioned in the available information. Users are encouraged to apply the official fix provided by the package maintainers once it is released.
Conclusion
In conclusion, the texlive-bin package in the Debian:12 and Debian:13 ecosystems is vulnerable to a segmentation violation in the OTFCC commit 617837b. This vulnerability can lead to a crash or unexpected behavior when executing the otfccdump binary, potentially causing a denial-of-service (DoS) condition. It is recommended to update the texlive-bin package to a patched version once it becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
texlive-bin is a package in the TeX Live distribution that provides various binaries for TeX-related tasks. It is commonly used for typesetting documents and working with LaTeX.
OTFCC is a command-line tool for manipulating OpenType fonts. It is used for tasks such as converting fonts between different formats and modifying font metadata.
A segmentation violation, also known as a segmentation fault, is a type of error that occurs when a program tries to access a memory location that it is not allowed to access. This can happen due to programming errors or vulnerabilities in the program.
The vulnerability can lead to a crash or unexpected behavior when executing the otfccdump binary. This can result in a denial-of-service (DoS) condition, potentially affecting the availability of the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
