Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35049: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b03b5. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OTFCC is an open-source font converter and editor. It is used to manipulate OpenType and TrueType fonts. The package texlive-bin, specifically in the Debian 12 and Debian 13 ecosystems, is affected by a heap buffer overflow vulnerability. This vulnerability can be exploited via the otfccdump+0x6b03b5 function in the release-x64 binary.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35049, allows an attacker to trigger a heap buffer overflow. This can lead to arbitrary code execution or a denial of service condition. The vulnerability was introduced in version 0 of the texlive-bin package. The severity of this vulnerability is rated as unimportant.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The heap buffer overflow vulnerability in the texlive-bin package can have serious security implications. It is recommended to update the package to a patched version as soon as it becomes available. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font converter and editor used for manipulating OpenType and TrueType fonts.
The texlive-bin package is a collection of binaries for the TeX Live distribution. It includes various tools and utilities related to typesetting and document preparation.
The heap buffer overflow occurs due to a vulnerability in the otfccdump+0x6b03b5 function in the release-x64 binary of the texlive-bin package. An attacker can exploit this vulnerability to overwrite adjacent memory locations and potentially execute arbitrary code.
The heap buffer overflow vulnerability can lead to arbitrary code execution or a denial of service condition. An attacker could exploit this vulnerability to gain control over the affected system or cause it to crash, resulting in a loss of availability.
A fix for this vulnerability is expected to be released by the texlive-bin package maintainers. Users are advised to update their texlive-bin package as soon as the fix becomes available.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
