Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35044: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x617087. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OTFCC is an open-source font converter and editor. It is used to manipulate OpenType and TrueType fonts. The package texlive-bin, specifically in the Debian 12 and Debian 13 ecosystems, is affected by a heap buffer overflow vulnerability. This vulnerability can be exploited through the otfccdump component of the package.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35044, originates from a commit (617837b) in the OTFCC source code. It allows an attacker to trigger a heap buffer overflow by providing malicious input to the otfccdump tool. This can lead to arbitrary code execution or a denial of service condition. The severity of this vulnerability is rated as unimportant.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the texlive-bin package in the Debian 12 and Debian 13 ecosystems is vulnerable to a heap buffer overflow in the OTFCC component. It is crucial to update the package to a patched version as soon as it becomes available. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font converter and editor used for manipulating OpenType and TrueType fonts.
texlive-bin is a package in the Debian ecosystem that provides binaries for the TeX Live typesetting system.
A heap buffer overflow occurs when a program writes data beyond the allocated memory buffer in the heap, potentially overwriting critical data or executing arbitrary code.
This vulnerability can lead to arbitrary code execution or a denial of service condition, depending on how it is exploited.
The severity of this vulnerability is rated as unimportant.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
