Heap-Buffer Overflow in OTFCC v0.10.4
Summary
CVE-2022-35452: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b0b2c. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OTFCC (OpenType Font Compiler Collection) is a software package used for manipulating and converting OpenType fonts. It provides various tools for font developers and designers. The vulnerability affects version 0.10.4 of OTFCC. This version contains a heap-buffer overflow vulnerability in the 'otfccdump' component.
Vulnerability Detail
The heap-buffer overflow vulnerability in OTFCC v0.10.4 can be exploited by an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a denial of service (DoS) condition. The vulnerability occurs in the 'otfccdump' tool, specifically at the address '0x6b0b2c'. An attacker can craft a malicious font file or input that triggers the overflow, allowing them to execute arbitrary code or crash the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is advised to apply the official patch or update to a fixed version of OTFCC as soon as it is released.
Conclusion
The heap-buffer overflow vulnerability in OTFCC v0.10.4 poses a significant risk to systems using this software. It is crucial to update to a patched version or apply the official fix as soon as it becomes available. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC (OpenType Font Compiler Collection) is a software package used for manipulating and converting OpenType fonts. It provides various tools for font developers and designers.
A heap-buffer overflow is a type of vulnerability where a program writes data beyond the allocated buffer in the heap memory. This can lead to memory corruption, crashes, or even arbitrary code execution.
An attacker can craft a malicious font file or input that triggers the heap-buffer overflow in the 'otfccdump' tool. By exploiting this vulnerability, the attacker can execute arbitrary code or crash the application.
At the time of this report, a patch for the heap-buffer overflow vulnerability in OTFCC v0.10.4 is not yet available. It is recommended to update to a fixed version as soon as it is released by the developers.
The heap-buffer overflow vulnerability in OTFCC v0.10.4 can potentially allow an attacker to execute arbitrary code on a vulnerable system or cause a denial of service by crashing the application.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
