Heap-Buffer Overflow Vulnerability in texlive-bin Package
Summary
DEBIAN-CVE-2022-35453: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c08a6. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes various binaries and scripts necessary for processing TeX documents. This package is widely used in academic and professional settings for producing high-quality typeset documents. However, it has been found to be vulnerable to a heap-buffer overflow, which can lead to severe security issues.
Vulnerability Detail
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c08a6. This vulnerability allows an attacker to exploit the buffer overflow, potentially leading to arbitrary code execution or a crash of the application. The vulnerability originates from improper handling of memory allocation, which can be triggered by specially crafted input, posing a significant risk to systems using the affected package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected version of OTFCC and refrain from processing untrusted TeX documents until the package is updated. Additionally, consider using alternative tools for typesetting that do not rely on texlive-bin.
Conclusion
The texlive-bin package has a critical heap-buffer overflow vulnerability that can lead to severe security risks. It is essential for users to update to the latest patched version to protect their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for texlive-bin →
FAQ
A heap-buffer overflow occurs when a program writes more data to a buffer located on the heap than it was allocated for, which can lead to memory corruption and potential exploitation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include arbitrary code execution, system crashes, and potential data breaches, which can compromise the integrity and security of the affected systems.
Yes, a patched version of the texlive-bin package is available. Users should update to the latest version to mitigate the vulnerability.
If immediate updates are not possible, avoid using the affected functionalities and consider using alternative tools until the package can be safely updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
