Segmentation Violation in texlive-bin Package: CVE-2022-35485
Summary
DEBIAN-CVE-2022-35485: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The texlive-bin package is part of the TeX Live distribution, which is a comprehensive collection of TeX-related software. It provides essential tools for typesetting documents, including the ability to create PDFs and other formats from LaTeX source files. The package is widely used in academia and publishing for its powerful typesetting capabilities. However, it has been identified to contain a vulnerability that could lead to segmentation violations, potentially affecting users' systems.
Vulnerability Detail
CVE-2022-35485 is a vulnerability found in OTFCC version 0.10.4, which is included in the texlive-bin package. The issue arises from a segmentation violation that occurs when the software processes certain inputs. This vulnerability can lead to crashes or unexpected behavior in applications that rely on texlive-bin, potentially exposing systems to further attacks or data corruption. The root cause of the issue is a flaw in the handling of specific data structures within the OTFCC library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific features of the texlive-bin package that trigger the segmentation violation until an update is applied. Additionally, consider using alternative tools for document processing that do not rely on texlive-bin.
Conclusion
CVE-2022-35485 presents a segmentation violation risk in the texlive-bin package, which can lead to application crashes. Users are encouraged to update their packages to the latest version to mitigate this vulnerability. Temporary workarounds are available, but addressing the issue through updates is the best course of action.
See every vulnerability recorded for texlive-bin →
FAQ
CVE-2022-35485 is a vulnerability in the texlive-bin package that can cause segmentation violations, leading to application crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If an immediate update is not possible, avoid using the features of texlive-bin that may trigger the segmentation violation as a temporary workaround.
The urgency of this vulnerability is classified as unimportant, but it is still advisable to address it to prevent potential issues.
More details can be found in the official CVE database or through the Debian security advisories related to CVE-2022-35485.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
