Heap-Buffer Overflow in OTFCC v0.10.4
Summary
CVE-2022-35465: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0414. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC v0.10.4 is a software package used for font conversion and manipulation. It provides various tools and utilities for working with OpenType fonts. The package is commonly used in the Debian ecosystem, specifically in the texlive-bin package for Debian versions 12 and 13. OTFCC v0.10.4 is vulnerable to a heap-buffer overflow.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35465, originates from a heap-buffer overflow in the /release-x64/otfccdump+0x6c0414 component of OTFCC v0.10.4. This vulnerability can be exploited by an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a denial of service (DoS) condition. The severity of this vulnerability is rated as unimportant.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
OTFCC v0.10.4 is vulnerable to a heap-buffer overflow, which can potentially lead to arbitrary code execution or a denial of service condition. Users of the texlive-bin package in Debian versions 12 and 13 are advised to update to a patched version as soon as it becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC v0.10.4 is a software package used for font conversion and manipulation, commonly used in the Debian ecosystem.
A heap-buffer overflow is a type of vulnerability where a program writes more data to a buffer in the heap than it can hold, potentially overwriting adjacent memory locations.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service (DoS) condition.
The severity of this vulnerability is rated as unimportant.
To fix this vulnerability, update the texlive-bin package to a version that includes a patched version of OTFCC.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
