Segmentation Violation in texlive-bin Package - CVE-2022-35029
Summary
DEBIAN-CVE-2022-35029: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a collection of binaries for the TeX Live distribution, which is widely used for typesetting documents. It provides essential tools for handling various types of documents and is crucial for users who rely on TeX for high-quality typesetting. This package is integral to many academic and professional workflows, making its security and stability paramount.
Vulnerability Detail
CVE-2022-35029 is a vulnerability discovered in the OTFCC commit 617837b, which leads to a segmentation violation when using the otfccdump tool within the texlive-bin package. This issue can cause the application to crash unexpectedly, potentially leading to data loss or disruption of services that depend on the package. The vulnerability arises from improper handling of certain inputs, which can be exploited to trigger the segmentation fault.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, users should update the texlive-bin package to the latest patched version. This can typically be done using the package manager with the following command:
sudo apt update && sudo apt upgrade texlive-bin
It is recommended to regularly check for updates to ensure that all packages are secure.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump tool until the package is updated. Additionally, running the application in a controlled environment where the potential for exploitation is minimized can help mitigate risks.
Conclusion
The CVE-2022-35029 vulnerability in the texlive-bin package poses a risk of segmentation violations, leading to application crashes. Users are encouraged to update their packages to mitigate this issue and consider using Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35029 is a vulnerability in the texlive-bin package that causes a segmentation violation, leading to application crashes.
This vulnerability can cause the texlive-bin package to crash, potentially disrupting workflows that rely on TeX for document processing.
Yes, users are advised to update the texlive-bin package to the latest version where this vulnerability has been addressed.
As a workaround, avoid using the otfccdump tool and consider running the application in a more secure environment.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities without signing up at the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.