Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35048: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0b2c. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is an open-source font converter and editor. It is used for manipulating OpenType and TrueType fonts. The package texlive-bin, specifically in versions for Debian 12 and Debian 13, includes the OTFCC tool. This tool allows users to dump font information. However, a vulnerability has been discovered in commit 617837b of OTFCC, which introduces a heap buffer overflow.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35048, arises from a heap buffer overflow in the OTFCC tool. This overflow occurs in the /release-x64/otfccdump+0x6b0b2c function. An attacker can exploit this vulnerability by crafting a malicious font file and tricking a user into opening it with the vulnerable OTFCC tool. If successful, the attacker can execute arbitrary code on the target system, potentially leading to remote code execution or a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the OTFCC tool or opening untrusted font files with it. By refraining from using the vulnerable functionality, the risk of exploitation can be mitigated. However, this is not a permanent solution, and updating the package is still necessary.
Conclusion
In conclusion, the OTFCC tool in the texlive-bin package for Debian 12 and Debian 13 is vulnerable to a heap buffer overflow. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. It is crucial to update the package to a patched version and follow best practices for software updates. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font converter and editor used for manipulating OpenType and TrueType fonts.
The vulnerability allows an attacker to execute arbitrary code on the target system, potentially leading to remote code execution or a denial of service.
To fix this vulnerability, update the texlive-bin package to a version that includes a patch for the OTFCC tool.
As a temporary workaround, avoid using the OTFCC tool or opening untrusted font files with it.
For more information, you can refer to the source link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
