Heap Buffer Overflow in texlive-bin Package: CVE-2022-35039
Summary
DEBIAN-CVE-2022-35039: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e20a0. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is part of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes various utilities and binaries necessary for processing TeX documents. This package is widely used in academic and professional settings for producing high-quality printed materials. However, it has been found to be vulnerable to a heap buffer overflow, which can lead to potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35039, originates from a specific commit in the OTFCC library, where a heap buffer overflow was discovered in the otfccdump utility. This flaw allows an attacker to exploit the buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability is classified as unimportant in terms of urgency, but it still poses a risk to systems using the affected versions of the texlive-bin package.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, users should update the texlive-bin package to the latest patched version available in their Debian repositories. This can typically be done using the following command in the terminal:
sudo apt update && sudo apt upgrade texlive-bin
Ensure that your system is connected to the internet to download the updates.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump utility until a patch is applied. This can help mitigate the risk of exploitation while waiting for an official fix.
Conclusion
The texlive-bin package has a vulnerability (CVE-2022-35039) that could lead to a heap buffer overflow. Users are advised to update their packages to the latest version to mitigate this risk. Temporary workarounds are available, but addressing the vulnerability through updates is the best course of action.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35039 is a vulnerability in the texlive-bin package that allows for a heap buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If an immediate update is not possible, refrain from using the otfccdump utility as a temporary workaround to mitigate risks.
The vulnerability is classified as unimportant in urgency, but it still poses a risk and should be addressed promptly.
More details can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-35039.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.