Global Buffer Overflow in texlive-bin Package - CVE-2022-35021
Summary
DEBIAN-CVE-2022-35021: OTFCC commit 617837b was discovered to contain a global buffer overflow via /release-x64/otfccdump+0x718693. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes essential binaries for processing TeX documents and is widely used in academia and publishing. The package is designed to facilitate the creation of high-quality typeset documents, but it has been found to be vulnerable to a global buffer overflow, which can compromise system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2022-35021 originates from a specific commit (617837b) in the OTFCC project. It allows for a global buffer overflow through the otfccdump binary, which can lead to arbitrary code execution or system crashes. This vulnerability poses a significant risk as it can be exploited by attackers to execute malicious code, potentially gaining unauthorized access to sensitive data or system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump binary until the package is updated. Additionally, restricting access to the binaries and monitoring system logs for unusual activity can help mitigate potential exploitation.
Conclusion
The texlive-bin package is vulnerable to a global buffer overflow as identified in CVE-2022-35021. Users are strongly advised to update their packages to the latest version to mitigate risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35021 is a vulnerability in the texlive-bin package that allows for a global buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
The risks include unauthorized access to sensitive data, system crashes, and the potential for attackers to execute malicious code on the affected system.
Yes, a patched version of the texlive-bin package is available. Users should update their package to ensure they are protected.
If an immediate update is not possible, consider using the workaround of avoiding the otfccdump binary and monitoring your system for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
