Heap Buffer Overflow in texlive-bin Package: CVE-2022-35048
Summary
DEBIAN-CVE-2022-35048: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0b2c. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite for typesetting documents. It includes various utilities and binaries necessary for processing TeX documents. This package is widely used in academic and professional settings for producing high-quality typeset documents. However, it has been found to be vulnerable to a heap buffer overflow, which can lead to severe security implications.
Vulnerability Detail
The vulnerability identified as CVE-2022-35048 originates from a commit in the OTFCC library, specifically commit 617837b. It exposes a heap buffer overflow through the otfccdump utility, which is part of the texlive-bin package. This flaw can potentially allow an attacker to execute arbitrary code, leading to unauthorized access or control over the affected system. The vulnerability is classified as unimportant in terms of urgency, but it still poses a risk that should not be overlooked.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump utility until the package is updated. This will mitigate the risk of exploitation through this specific vulnerability.
Conclusion
The texlive-bin package has a vulnerability (CVE-2022-35048) that can lead to a heap buffer overflow, posing a risk of arbitrary code execution. Users are advised to update the package to the latest version to mitigate this risk. Temporary workarounds are available, but it is crucial to address the vulnerability promptly.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35048 is a vulnerability in the texlive-bin package that allows for a heap buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability.
While classified as unimportant, it can still pose a risk if exploited, allowing unauthorized access to the system.
If an immediate update is not possible, refrain from using the otfccdump utility as a temporary workaround to mitigate risk.
You can find detailed information about vulnerabilities on platforms like Vulert, which provides real-time monitoring for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
