Segmentation Violation in texlive-bin Package - CVE-2022-35486
Summary
DEBIAN-CVE-2022-35486: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a collection of binaries for the TeX Live typesetting system, which is widely used for producing high-quality documents. It includes tools for processing TeX files and generating various output formats. This package is essential for users who rely on TeX for document preparation. However, it has been found to be vulnerable to a segmentation violation, which can lead to application crashes and potential data loss.
Vulnerability Detail
CVE-2022-35486 is a vulnerability discovered in OTFCC v0.10.4, which is utilized by the texlive-bin package. The vulnerability arises from a segmentation violation that occurs when the software attempts to access memory that it is not allowed to. This can lead to unexpected behavior, including crashes and potential exploitation by malicious actors. The issue is particularly concerning as it can compromise the stability of applications relying on texlive-bin, affecting users' ability to create and manage documents effectively.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific features of the texlive-bin package that trigger the segmentation violation until the package is updated. It is advisable to monitor the package updates regularly to ensure that the vulnerability is addressed promptly.
Conclusion
The texlive-bin package is vulnerable to a segmentation violation as identified in CVE-2022-35486. Users are encouraged to update their packages to mitigate this issue and ensure the stability of their document processing applications. Regular monitoring for vulnerabilities is essential to maintain system security.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35486 is a vulnerability in the texlive-bin package that causes a segmentation violation, potentially leading to application crashes.
This vulnerability can lead to instability in applications that rely on the texlive-bin package, affecting document processing and potentially causing data loss.
Yes, users can update the texlive-bin package to the latest version to patch the vulnerability.
As a temporary measure, avoid using features of the texlive-bin package that may trigger the segmentation violation until an update can be applied.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check for vulnerabilities in your application without signing up at the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
