Heap-buffer overflow in OTFCC v0.10.4
Summary
CVE-2022-35461: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0a32. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is a software package used for manipulating OpenType and TrueType fonts. It provides various tools for font conversion, editing, and analysis. The vulnerability affects version 0.10.4 of OTFCC. This version contains a heap-buffer overflow vulnerability in the 'otfccdump' component.
Vulnerability Detail
The heap-buffer overflow vulnerability in OTFCC v0.10.4 occurs at the memory allocation stage of the 'otfccdump' tool. An attacker can exploit this vulnerability by providing a specially crafted input file, leading to a buffer overflow. This can result in arbitrary code execution or a denial of service condition. The vulnerability has a CVSSv3 score of 6.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'otfccdump' tool or restrict its usage to trusted input files only. This can help mitigate the risk of exploitation until a patched version is available.
Conclusion
In conclusion, OTFCC v0.10.4 is vulnerable to a heap-buffer overflow in the 'otfccdump' tool. Users should update to a patched version of OTFCC to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is a software package used for manipulating OpenType and TrueType fonts. It provides various tools for font conversion, editing, and analysis.
The vulnerability can lead to arbitrary code execution or a denial of service condition, depending on how it is exploited.
The CVSSv3 score of this vulnerability is 6.5, indicating a medium severity level.
To fix this vulnerability, it is recommended to update to a patched version of OTFCC that addresses the heap-buffer overflow issue.
As a temporary workaround, users can avoid using the 'otfccdump' tool or restrict its usage to trusted input files only.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
