Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35067: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b0. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OTFCC is an open-source font conversion and manipulation tool. It is used for converting OpenType fonts to other formats and performing various operations on font files. The package 'texlive-bin' in the Debian ecosystem, specifically versions 12 and 13, includes OTFCC. This vulnerability, identified as CVE-2022-35067, is a heap buffer overflow that exists in the commit 617837b of OTFCC. The overflow occurs in the 'otfccdump' component of the package.
Vulnerability Detail
The heap buffer overflow vulnerability in OTFCC can be exploited by an attacker to execute arbitrary code or cause a denial of service. By providing specially crafted input to the 'otfccdump' utility, an attacker can trigger the overflow and potentially gain control over the affected system. This vulnerability has a CVSSv3 score of 6.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At the moment, no specific workaround has been provided for this vulnerability. Users are advised to follow the recommended fix and update their 'texlive-bin' package to a patched version as soon as it becomes available.
Conclusion
In conclusion, the OTFCC package included in the 'texlive-bin' package in the Debian ecosystem is vulnerable to a heap buffer overflow. This vulnerability can be exploited to execute arbitrary code or cause a denial of service. It is recommended to update the 'texlive-bin' package to a patched version as soon as it becomes available. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font conversion and manipulation tool used for working with OpenType fonts.
'texlive-bin' is a package in the Debian ecosystem that includes various binaries and utilities related to the TeX Live system.
A heap buffer overflow is a type of software vulnerability where a program writes more data to a buffer in the heap memory than it can hold. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a crash.
The CVSSv3 score of this vulnerability is 6.5, indicating a medium severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
