Global Overflow Vulnerability in OTFCC v0.10.4
Summary
CVE-2022-35472: OTFCC v0.10.4 was discovered to contain a global overflow via /release-x64/otfccdump+0x718693. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC v0.10.4 is a software package used for font conversion and manipulation. It provides various tools and utilities for working with OpenType fonts. The package is commonly used in the Debian ecosystem, specifically in versions 12 and 13 of the texlive-bin package.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35472, is a global overflow issue in OTFCC v0.10.4. It occurs specifically in the /release-x64/otfccdump+0x718693 component of the software. This vulnerability can be exploited to execute arbitrary code or cause a denial-of-service attack. The severity of this vulnerability is rated as moderate with a CVSS score of 6.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the OTFCC v0.10.4 package in the texlive-bin package has a global overflow vulnerability that can be exploited to execute arbitrary code or cause a denial-of-service attack. Users are advised to update their texlive-bin package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
This vulnerability can be exploited to execute arbitrary code or cause a denial-of-service attack.
The vulnerability is present in OTFCC v0.10.4.
Yes, the CVSS score for this vulnerability is 6.5.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about this vulnerability in the CVE-2022-35472 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35472.json
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
