Heap Buffer Overflow in texlive-bin Package: CVE-2022-35460
Summary
DEBIAN-CVE-2022-35460: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x61731f. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes various utilities for processing TeX documents and is widely used in academic and professional settings. However, a vulnerability has been identified in version 0.10.4 of OTFCC, a tool included in this package, which could lead to severe security risks.
Vulnerability Detail
CVE-2022-35460 is a heap-buffer overflow vulnerability found in OTFCC v0.10.4. This vulnerability arises from improper handling of memory allocation, which can be exploited by an attacker to execute arbitrary code or crash the application. The potential ramifications include unauthorized access to sensitive data or system compromise, making it critical for users of the texlive-bin package to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific features of OTFCC that are vulnerable until the package is updated. Additionally, running the application in a controlled environment or sandbox may help mitigate potential risks.
Conclusion
The CVE-2022-35460 vulnerability in the texlive-bin package poses significant risks due to a heap-buffer overflow in OTFCC v0.10.4. It is crucial for users to update their packages promptly to mitigate these risks and ensure the security of their systems.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35460 is a vulnerability in the texlive-bin package that allows for a heap-buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The risks include unauthorized access to sensitive data, system crashes, and potential exploitation by attackers to execute malicious code.
Yes, updating the texlive-bin package to the latest version will include the necessary patches to fix this vulnerability.
If an immediate update is not possible, consider using a workaround such as avoiding the vulnerable features of OTFCC or running the application in a sandboxed environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
