Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35063: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41a8. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The texlive-bin package is a part of the Debian ecosystem and is used for typesetting documents with TeX. It provides various utilities and binaries for working with TeX files. One of the binaries included in the package is otfccdump, which is used for extracting information from OpenType and TrueType fonts. This vulnerability affects the texlive-bin package in Debian versions 12 and 13.
Vulnerability Detail
The OTFCC commit 617837b in texlive-bin contains a heap buffer overflow vulnerability. This vulnerability can be exploited via the otfccdump binary, specifically at the address +0x6e41a8. An attacker can potentially trigger this heap buffer overflow by providing a specially crafted input file, leading to arbitrary code execution or a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is recommended to apply the official patch or update the texlive-bin package to mitigate the risk.
Conclusion
The texlive-bin package in Debian versions 12 and 13 is vulnerable to a heap buffer overflow in the otfccdump binary. It is crucial to update the package to the latest version or apply the provided patch to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
texlive-bin is a package in the Debian ecosystem that provides utilities and binaries for working with TeX files.
otfccdump is a binary included in the texlive-bin package that is used for extracting information from OpenType and TrueType fonts.
A heap buffer overflow is a type of vulnerability where a program writes more data into a buffer in the heap than it can hold, potentially overwriting adjacent memory and leading to arbitrary code execution or a crash.
This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service by crashing the affected program.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if you are vulnerable.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
