Heap Buffer Overflow in texlive-bin Package: CVE-2022-35045
Summary
DEBIAN-CVE-2022-35045: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0d63. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is part of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes various binaries and scripts necessary for processing TeX documents. This package is widely used in academic and professional settings for producing high-quality typeset documents. However, it has been identified to contain a vulnerability that could potentially compromise system integrity.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35045, originates from a commit in the OTFCC library, specifically commit 617837b. It manifests as a heap buffer overflow, which occurs when a program writes more data to a buffer located on the heap than it can hold. This can lead to memory corruption, allowing an attacker to execute arbitrary code, potentially leading to system crashes or unauthorized access. The urgency of this vulnerability is classified as unimportant, but it still poses a risk to systems running affected versions of the texlive-bin package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workarounds have been documented for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
In summary, CVE-2022-35045 is a significant vulnerability affecting the texlive-bin package, which can lead to severe consequences if left unaddressed. Users are strongly advised to update their packages promptly and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35045 is a vulnerability in the texlive-bin package that allows for a heap buffer overflow, potentially leading to memory corruption and arbitrary code execution.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without any signup.
The risks include potential system crashes, unauthorized access, and execution of arbitrary code, which could compromise system integrity.
Yes, users are encouraged to update the texlive-bin package to the latest version to mitigate the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It helps developers ensure their applications are secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
