Heap-buffer overflow in OTFCC v0.10.4
Summary
CVE-2022-35475: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6e41a8. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OTFCC v0.10.4 is a software package used for font conversion and manipulation. It provides various tools and functionalities for working with OpenType fonts. The package is commonly used in the Debian ecosystem, specifically in the texlive-bin package for Debian versions 12 and 13.
Vulnerability Detail
The vulnerability identified as CVE-2022-35475 is a heap-buffer overflow in OTFCC v0.10.4. This vulnerability can be exploited via the 'otfccdump' component of the package. An attacker can trigger the overflow by providing specially crafted input, potentially leading to arbitrary code execution or a denial of service (DoS) condition. The vulnerability has been assigned a CVSSv3 score of 6.5, indicating a moderate severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At the moment, no specific workaround has been provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to update to a patched version of the package.
Conclusion
In conclusion, the OTFCC v0.10.4 package used in the texlive-bin package for Debian versions 12 and 13 is vulnerable to a heap-buffer overflow. This vulnerability can potentially lead to arbitrary code execution or a denial of service condition. It is recommended to update to a patched version of the package as soon as possible. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service (DoS) condition.
Yes, the vulnerability affects the texlive-bin package in Debian versions 12 and 13, which includes the OTFCC v0.10.4 package.
There are no known instances of this vulnerability being actively exploited at the moment.
Yes, the vulnerability has been assigned a CVSSv3 score of 6.5, indicating a moderate severity.
You can find more information about this vulnerability in the CVE-2022-35475 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35475.json
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
