Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35062: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0bc3. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is an open-source font editor and converter. It is used for manipulating and converting OpenType and TrueType fonts. The package texlive-bin, specifically in the Debian 12 and Debian 13 ecosystems, is affected by a heap buffer overflow vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35062, originates from a commit (617837b) in the OTFCC codebase. It allows for a heap buffer overflow to occur in the /release-x64/otfccdump+0x6c0bc3 function. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. The severity of this vulnerability is rated as unimportant with a CVSS v3 score of 6.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At present, no specific workaround has been provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the issue.
Conclusion
In conclusion, the texlive-bin package in the Debian 12 and Debian 13 ecosystems is affected by a heap buffer overflow vulnerability in the OTFCC codebase. It is crucial to update the package to a patched version once it becomes available. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font editor and converter used for manipulating and converting OpenType and TrueType fonts.
texlive-bin is a package in the Debian ecosystem that provides the binaries for the TeX Live distribution.
A heap buffer overflow is a type of vulnerability where a program writes more data to a buffer in the heap than it can hold. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
The CVSS v3 score for this vulnerability is 6.5, which indicates a medium severity.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
