Heap Buffer Overflow in texlive-bin Package - CVE-2022-35069
Summary
DEBIAN-CVE-2022-35069: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b544e. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite for typesetting documents. It includes various utilities and scripts that facilitate the processing of TeX files. This package is widely used in academic and professional settings for producing high-quality documents. However, it has been found to be vulnerable to a heap buffer overflow, which can lead to potential exploitation.
Vulnerability Detail
The vulnerability identified as CVE-2022-35069 originates from a specific commit in the OTFCC project, where a heap buffer overflow was discovered in the otfccdump utility. This flaw allows an attacker to manipulate memory allocation, potentially leading to arbitrary code execution or crashes. The vulnerability affects all versions of the texlive-bin package across Debian 12, 13, and 14, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump utility until the package is updated. This may limit some functionalities but will help mitigate the risk of exploitation until a fix is applied.
Conclusion
The texlive-bin package has a significant vulnerability (CVE-2022-35069) that can lead to severe security risks. Users are advised to update their packages promptly and consider using Vulert to monitor their applications for vulnerabilities. By taking these steps, users can protect their systems from potential threats.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35069 is a vulnerability in the texlive-bin package that allows for a heap buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The risks include potential arbitrary code execution, system crashes, and unauthorized access to sensitive information.
Yes, a patched version of the texlive-bin package is available. Users should update their package to the latest version to mitigate the risk.
If an immediate update is not possible, refrain from using the otfccdump utility as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
