Heap-Buffer Overflow Vulnerability in texlive-bin Package
Summary
DEBIAN-CVE-2022-35456: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x617087. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes various utilities for processing TeX files, making it essential for users who rely on TeX for high-quality document preparation. However, the package has been found to be vulnerable to a heap-buffer overflow, which can lead to severe security issues if exploited.
Vulnerability Detail
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x617087. This vulnerability allows an attacker to potentially execute arbitrary code, leading to unauthorized access or control over the affected system. The flaw originates from improper handling of memory allocation, which can be exploited by crafting specific inputs that exceed allocated buffer sizes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functionalities of the texlive-bin package that involve the vulnerable component until a patch is applied. Additionally, consider restricting access to the application to trusted users only.
Conclusion
The texlive-bin package is vulnerable to a heap-buffer overflow, which poses significant security risks. Users are encouraged to update their packages promptly and consider using tools like Vulert to monitor for vulnerabilities in their software. By staying informed and proactive, users can better protect their systems from potential threats.
See every vulnerability recorded for texlive-bin →
FAQ
A heap-buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability can lead to arbitrary code execution, allowing attackers to gain unauthorized access to the system, manipulate data, or disrupt services.
Yes, if exploited, this vulnerability could lead to data corruption or loss, as attackers may manipulate or delete critical files on the affected system.
It is advisable to regularly check for updates and apply them as soon as they are available, especially for packages that are critical to your system's security.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
