Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35043: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c08a6. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is an open-source font converter and editor. It is used to manipulate OpenType and TrueType fonts. The package texlive-bin, specifically in versions for Debian 12 and Debian 13, includes the OTFCC tool. This tool is vulnerable to a heap buffer overflow, which can be exploited to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35043, originates from a commit (617837b) in the OTFCC source code. It allows an attacker to trigger a heap buffer overflow by providing a specially crafted input to the otfccdump utility. This can lead to the execution of arbitrary code or a crash of the application. The severity of this vulnerability is rated as unimportant.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no known workarounds exist for this vulnerability. It is essential to apply the official patch or update the package to mitigate the risk.
Conclusion
The OTFCC tool in the texlive-bin package for Debian 12 and Debian 13 is vulnerable to a heap buffer overflow. This can be exploited to execute arbitrary code or cause a denial of service. It is crucial to update the package to the latest version or apply the official patch to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font converter and editor used for manipulating OpenType and TrueType fonts.
texlive-bin is a package in the Debian ecosystem that includes various binaries related to the TeX Live distribution.
A heap buffer overflow occurs when a program writes data beyond the allocated buffer in the heap memory. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or crash the application.
This vulnerability can be exploited by an attacker to execute arbitrary code on a vulnerable system or cause a denial of service by crashing the application.
Yes, it is recommended to update the texlive-bin package to a version that includes a patch for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
