Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35038: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b064d. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-5~hurd.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is a font converter and editor for OpenType and TrueType fonts. It is used to manipulate font files and perform various operations on them. The package texlive-bin, specifically in the Debian 12 and Debian 13 ecosystems, is affected by a heap buffer overflow vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35038, is present in the OTFCC commit 617837b. It allows for a heap buffer overflow to occur through the execution of the /release-x64/otfccdump+0x6b064d function. This vulnerability can potentially lead to arbitrary code execution or denial of service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At present, no specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and update the texlive-bin package to mitigate the risk.
Conclusion
In conclusion, the OTFCC commit 617837b in the texlive-bin package is vulnerable to a heap buffer overflow. It is crucial to update the texlive-bin package to the latest version that includes a fix for this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is a font converter and editor for OpenType and TrueType fonts. It is used to manipulate font files and perform various operations on them.
texlive-bin is a package in the Debian ecosystem that provides binaries for the TeX Live distribution. It includes various tools and utilities related to typesetting and document preparation.
A heap buffer overflow is a type of vulnerability where a program writes data beyond the allocated memory buffer in the heap. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
The heap buffer overflow in OTFCC can potentially allow an attacker to execute arbitrary code on the affected system or cause a denial of service by crashing the application or system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
