Heap Buffer Overflow in texlive-bin Package: CVE-2022-35467
Summary
DEBIAN-CVE-2022-35467: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6e41b8. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a collection of binaries for the TeX Live distribution, which is widely used for typesetting documents. It provides essential tools for processing TeX documents and is integral to many academic and professional workflows. However, the package has been identified to contain a vulnerability that could lead to severe security issues.
Vulnerability Detail
CVE-2022-35467 is a vulnerability found in OTFCC v0.10.4, specifically a heap-buffer overflow that can be triggered via the otfccdump utility. This flaw allows attackers to exploit the memory management of the application, potentially leading to arbitrary code execution or crashes. The vulnerability originates from improper handling of memory allocation, which can be manipulated by crafted input files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump utility until the package is updated. Additionally, ensure that any input files processed by the utility are from trusted sources to minimize risk.
Conclusion
The texlive-bin package has a critical vulnerability (CVE-2022-35467) that poses significant security risks. Users are urged to update their packages promptly and follow recommended practices to safeguard their systems.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35467 is a vulnerability in the texlive-bin package that allows for a heap-buffer overflow, which can lead to security risks such as arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, avoid using the otfccdump utility and ensure that any files processed are from trusted sources.
Yes, a patched version of the texlive-bin package is available. Users should update to the latest version to mitigate the vulnerability.
Exploitation of this vulnerability could lead to arbitrary code execution, crashes, or unauthorized access to system resources.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
