Heap Buffer Overflow in OTFCC
Summary
CVE-2022-35070: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x65fc97. Affects texlive-bin versions 2022.20220321.62855-5.1 – 2025.20250727.75242+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is an open-source font converter and editor. It is used for manipulating OpenType and TrueType fonts. The package texlive-bin, specifically in the Debian:12 and Debian:13 ecosystems, is affected by a heap buffer overflow vulnerability (CVE-2022-35070).
Vulnerability Detail
The vulnerability (CVE-2022-35070) was discovered in commit 617837b of OTFCC. It allows an attacker to trigger a heap buffer overflow through the otfccdump binary, specifically at the address +0x65fc97. This vulnerability can potentially lead to remote code execution or denial of service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to apply the official fix provided by the package maintainers.
Conclusion
In conclusion, the OTFCC package in the texlive-bin package of the Debian:12 and Debian:13 ecosystems is affected by a heap buffer overflow vulnerability (CVE-2022-35070). It is crucial to update the texlive-bin package to the latest version provided by the maintainers to mitigate the risk of remote code execution or denial of service attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is an open-source font converter and editor used for manipulating OpenType and TrueType fonts.
texlive-bin is a package in the Debian ecosystem that provides binaries for the TeX Live distribution.
A heap buffer overflow is a type of vulnerability where a program writes more data to a buffer in the heap than it can hold, leading to memory corruption and potential exploitation.
This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service by crashing the affected application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
