Heap Buffer Overflow Vulnerability in texlive-bin Package
Summary
DEBIAN-CVE-2022-35461: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0a32. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite for typesetting documents. It includes various utilities and scripts that facilitate the processing of TeX documents. However, the package has been identified to have a vulnerability that could potentially lead to severe security issues.
Vulnerability Detail
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0a32. This vulnerability allows an attacker to exploit the buffer overflow, which may lead to arbitrary code execution, data corruption, or system crashes. The issue arises from improper handling of memory allocation, making it a critical concern for users relying on this package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the affected features of the texlive-bin package until the update is applied. Additionally, running the package in a controlled environment, such as a virtual machine, may help mitigate potential risks.
Conclusion
The texlive-bin package has a critical heap buffer overflow vulnerability that can lead to severe security risks. Users are strongly advised to update to the latest patched version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for texlive-bin →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it was allocated for, potentially overwriting adjacent memory and leading to unpredictable behavior.
You can use Vulert, which allows you to monitor and alert in real-time for open-source vulnerabilities. By simply uploading your manifest file like package-lock.json, you can check if your application is affected.
Exploiting this vulnerability could lead to arbitrary code execution, data corruption, or crashes, compromising the integrity and security of the system.
Yes, a patched version of the texlive-bin package is available. Users should update to this version to mitigate the risk associated with the vulnerability.
If an immediate update is not possible, consider using a workaround by avoiding the affected features or running the package in a secure environment until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
