Heap-buffer overflow in OTFCC v0.10.4
Summary
CVE-2022-35462: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0bc3. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC is a software package used for font conversion and manipulation. It provides various tools and utilities for working with OpenType and TrueType fonts. The package is commonly used in the Debian ecosystem, specifically in the texlive-bin package. The texlive-bin package is utilized in Debian versions 12 and 13. The vulnerability, identified as CVE-2022-35462, is a heap-buffer overflow that exists in the OTFCC v0.10.4 version.
Vulnerability Detail
The heap-buffer overflow vulnerability in OTFCC v0.10.4 can be exploited via the 'release-x64/otfccdump+0x6c0bc3' function. This vulnerability allows an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a denial of service (DoS) attack. The impact of this vulnerability can vary depending on the context in which the affected software is used. It is important to note that this vulnerability has a CVSSv3 score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official patch or update the affected package as soon as a fix is released.
Conclusion
In conclusion, the OTFCC v0.10.4 package in the texlive-bin package of Debian versions 12 and 13 is vulnerable to a heap-buffer overflow. This vulnerability can potentially lead to arbitrary code execution or a denial of service attack. It is crucial to update the affected package as soon as a patch or updated version becomes available. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
The impact of this vulnerability can vary depending on the context in which the affected software is used. It could potentially allow an attacker to execute arbitrary code or cause a denial of service (DoS) attack.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any known vulnerabilities, including CVE-2022-35462.
At the time of writing, there is no specific patch available for this vulnerability. However, it is recommended to keep an eye on the official repositories for updates to the texlive-bin package, as the maintainers are likely to release a patched version soon.
There are currently no known exploits for this vulnerability. However, it is important to apply the necessary updates or patches as soon as they become available to mitigate the risk.
You can find more information about this vulnerability, including technical details and the latest updates, in the CVE-2022-35462 JSON report available at: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35462.json
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
