Segmentation Violation in texlive-bin Package - CVE-2022-35469
Summary
DEBIAN-CVE-2022-35469: OTFCC v0.10.4 was discovered to contain a segmentation violation via /x86_64-linux-gnu/libc.so.6+0xbb384. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite for typesetting documents. It includes various binaries and scripts necessary for processing TeX documents. This package is widely used in academic and professional settings for producing high-quality printed materials. However, it has been found to be vulnerable to a segmentation violation, which can lead to unexpected behavior or crashes.
Vulnerability Detail
CVE-2022-35469 is a vulnerability discovered in OTFCC v0.10.4, which is part of the texlive-bin package. The issue arises from a segmentation violation that occurs in the library libc.so.6, specifically at the offset +0xbb384. This vulnerability can potentially allow an attacker to exploit the segmentation fault, leading to application crashes or arbitrary code execution, depending on the context in which the library is used. The urgency of this vulnerability has been classified as unimportant, but it still poses risks to system stability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific features of the texlive-bin package that rely on the vulnerable OTFCC library until an update can be applied. Additionally, running the application in a controlled environment or using alternative software for document processing may mitigate the impact of this vulnerability.
Conclusion
The texlive-bin package has a known vulnerability (CVE-2022-35469) that can lead to segmentation violations. Users are encouraged to update their packages to the latest version to ensure system stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35469 is a vulnerability in the texlive-bin package that causes a segmentation violation, potentially leading to application crashes.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, to monitor for vulnerabilities.
The primary risks include application crashes and potential exploitation that could lead to arbitrary code execution, depending on how the library is utilized.
Yes, users are advised to update the texlive-bin package to the latest version to mitigate the vulnerability.
If an immediate update is not possible, consider using alternative software for document processing or limit the use of features that may trigger the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
