Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35061: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e412a. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is an open-source font editor and converter. It is used for manipulating OpenType and TrueType fonts. The package texlive-bin, specifically in the Debian 12 and Debian 13 ecosystems, is affected by a heap buffer overflow vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35061, is present in the OTFCC commit 617837b. It allows for a heap buffer overflow to occur in the /release-x64/otfccdump+0x6e412a function. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At present, no specific workaround has been provided for this vulnerability. It is advised to apply the official patch or update the package as soon as it becomes available.
Conclusion
In conclusion, the OTFCC commit 617837b in the texlive-bin package is vulnerable to a heap buffer overflow. It is crucial to update the package or apply the official patch once it becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font editor and converter used for manipulating OpenType and TrueType fonts.
This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service.
The vulnerability affects texlive-bin in the Debian 12 and Debian 13 ecosystems.
At the time of this report, no specific patch has been released. It is recommended to update the package once a patch becomes available.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
