Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35068: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is an open-source font editor and converter. It is used for manipulating and converting OpenType and TrueType fonts. The package texlive-bin, specifically in the Debian 12 and Debian 13 ecosystems, is affected by a heap buffer overflow vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35068, originates from a commit (617837b) in the OTFCC codebase. It allows for a heap buffer overflow through the execution of the otfccdump+0x6e420d function. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. The severity of this vulnerability is rated as unimportant with a CVSSv3 score of 6.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At present, no specific workaround has been provided for this vulnerability. It is recommended to follow the fix instructions and update the package as soon as an updated version is released.
Conclusion
In conclusion, the OTFCC package, specifically in the texlive-bin package in the Debian 12 and Debian 13 ecosystems, is vulnerable to a heap buffer overflow. It is crucial to update the texlive-bin package to a patched version as soon as it becomes available. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font editor and converter used for manipulating and converting OpenType and TrueType fonts.
texlive-bin is a package in the Debian ecosystem that provides the binaries for the TeX Live distribution.
A heap buffer overflow is a type of vulnerability where a program writes data beyond the allocated memory buffer, potentially leading to memory corruption and arbitrary code execution.
This vulnerability can allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition on systems with the vulnerable texlive-bin package.
The severity of this vulnerability is rated as unimportant with a CVSSv3 score of 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
