Segmentation Violation in texlive-bin Package: CVE-2022-35483
Summary
DEBIAN-CVE-2022-35483: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a crucial component of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents. It includes various binaries and scripts necessary for processing TeX documents. This package is widely used in academic and professional settings for producing high-quality typesetting. However, it has been identified to contain a vulnerability that could lead to unexpected behavior.
Vulnerability Detail
CVE-2022-35483 is a vulnerability found in OTFCC v0.10.4, which is part of the texlive-bin package. The issue arises from a segmentation violation that can occur during the execution of the otfccdump binary. This vulnerability can potentially lead to crashes or arbitrary code execution, posing a risk to systems using the affected version of the package. The root cause is linked to improper handling of memory, which can be exploited under certain conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the otfccdump binary until the package is updated. Additionally, consider running the application in a controlled environment to mitigate potential risks while waiting for the patch.
Conclusion
The CVE-2022-35483 vulnerability in the texlive-bin package poses a significant risk due to its potential for causing segmentation violations. Users are encouraged to update their packages promptly and consider using workarounds to mitigate risks until a fix is applied. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35483 is a vulnerability in the texlive-bin package that can cause a segmentation violation, potentially leading to crashes or code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If immediate updates are not possible, consider using the workaround of avoiding the otfccdump binary and running your application in a controlled environment.
While the primary concern is system stability and potential code execution, it is always advisable to back up important data before applying updates or changes.
You can find detailed information about the texlive-bin package and its updates on the official Debian package repository or the TeX Live documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
