Segmentation Violation in texlive-bin Package - CVE-2022-35065
Summary
DEBIAN-CVE-2022-35065: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a collection of binaries for the TeX Live distribution, which is widely used for typesetting documents. It provides essential tools for processing TeX documents, including font handling and document compilation. This package is crucial for users who rely on TeX for high-quality typesetting and document preparation. However, it has been identified to have a vulnerability that can lead to a segmentation violation, potentially affecting the stability of applications that depend on it.
Vulnerability Detail
CVE-2022-35065 originates from a commit in the OTFCC library, specifically commit 617837b, which introduces a segmentation violation when executing the otfccdump binary. This vulnerability can lead to unexpected behavior or crashes in applications that utilize this binary, posing a risk to system stability and data integrity. The technical aspect of this vulnerability lies in the improper handling of memory, which can be exploited under certain conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump binary until the package is updated. This may involve using alternative tools for font handling or document processing that do not rely on texlive-bin.
Conclusion
In summary, CVE-2022-35065 affects the texlive-bin package, leading to a segmentation violation that can impact application stability. Users are advised to update their packages to mitigate this risk and can utilize Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35065 is a vulnerability found in the texlive-bin package that can cause a segmentation violation, potentially leading to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider using alternative tools or temporarily avoiding the use of the otfccdump binary.
The urgency of this vulnerability is classified as unimportant, but it can still affect system stability.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-35065.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
