Heap Buffer Overflow in texlive-bin Package: CVE-2022-35068
Summary
DEBIAN-CVE-2022-35068: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, providing essential binaries for typesetting documents. It is widely used in academic and professional settings for creating high-quality documents. However, the package has been found to contain a vulnerability that could potentially compromise system integrity.
Vulnerability Detail
CVE-2022-35068 is a vulnerability identified in the OTFCC commit 617837b, which contains a heap buffer overflow. This flaw can be exploited by an attacker to execute arbitrary code, leading to potential data corruption or unauthorized access to system resources. The vulnerability arises from improper handling of memory allocation, making it critical for users of the texlive-bin package to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of the texlive-bin package until the update is applied. This may involve refraining from processing certain document types that utilize the vulnerable components.
Conclusion
The texlive-bin package has a critical vulnerability (CVE-2022-35068) that requires immediate attention. Users are advised to update their packages to the latest version to ensure system security. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35068 is a vulnerability in the texlive-bin package that allows for a heap buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Failing to address this vulnerability could lead to unauthorized access, data corruption, or system instability, posing significant risks to your system's security.
Yes, a patched version of the texlive-bin package is available. Users should update their package to the latest version to mitigate the risk.
If an immediate update is not possible, consider using a workaround by avoiding the use of features that may exploit the vulnerability until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
