Heap Buffer Overflow in texlive-bin Package - CVE-2022-35036
Summary
DEBIAN-CVE-2022-35036: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e1fc8. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes various utilities for handling fonts, graphics, and other elements essential for producing high-quality printed materials. This package is widely used in academic and professional settings for document preparation. However, it has been identified to have a vulnerability that could lead to severe security issues.
Vulnerability Detail
CVE-2022-35036 is a vulnerability found in the OTFCC commit 617837b, which contains a heap buffer overflow. This flaw can be exploited by attackers to execute arbitrary code, potentially leading to unauthorized access or manipulation of sensitive data. The vulnerability arises from improper handling of memory allocation, which can be triggered when processing certain input files. If exploited, it could compromise the integrity and confidentiality of the system running the affected package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider disabling the use of the affected functionalities within the texlive-bin package until a patch is applied. This can be done by avoiding the processing of files that may trigger the vulnerability.
Conclusion
In summary, CVE-2022-35036 is a significant vulnerability affecting the texlive-bin package, which can lead to severe security risks if left unaddressed. It is crucial to update the package to the latest version to mitigate these risks. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35036 is a security vulnerability in the texlive-bin package that allows for a heap buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, system compromise, and potential exploitation by malicious actors.
Yes, a patched version of the texlive-bin package is available. Updating the package will resolve the vulnerability.
If you cannot update the package, consider implementing workarounds such as avoiding the use of functionalities that may trigger the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
