Segmentation Violation in texlive-bin Package: CVE-2022-35476
Summary
DEBIAN-CVE-2022-35476: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite for typesetting documents. It includes various tools and scripts necessary for processing TeX documents. This package is widely used in academic and professional settings for producing high-quality typeset documents. However, it has been found to be vulnerable to a segmentation violation, which can lead to unexpected behavior or crashes.
Vulnerability Detail
CVE-2022-35476 is a vulnerability discovered in OTFCC version 0.10.4, which is utilized by the texlive-bin package. The vulnerability manifests as a segmentation violation when the otfccdump tool is executed, potentially leading to application crashes or unintended behavior. This issue arises from improper handling of certain inputs, which can be exploited to disrupt the normal operation of the software. Users of the texlive-bin package should be aware of this vulnerability as it may affect the stability and reliability of their document processing workflows.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump tool until the package is updated. Additionally, consider using alternative tools for document processing that do not rely on the vulnerable components of texlive-bin.
Conclusion
The segmentation violation in the texlive-bin package (CVE-2022-35476) poses a risk to users relying on this tool for document processing. It is essential to update the package to the latest version to mitigate this vulnerability and ensure stable operation. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35476 is a vulnerability in the texlive-bin package that causes a segmentation violation in the OTFCC tool, potentially leading to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, avoid using the otfccdump tool and consider using alternative document processing tools.
The urgency of this vulnerability is classified as unimportant, but it can still affect the stability of applications using the texlive-bin package.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-35476.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
