Segmentation Violation in OTFCC v0.10.4
Summary
CVE-2022-35482: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC v0.10.4 is a software package used for font conversion and manipulation. It provides various tools and utilities for working with OpenType fonts. The package is commonly used in the Debian ecosystem, specifically in versions 12 and 13. However, a vulnerability has been discovered in this version of OTFCC that can lead to a segmentation violation.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35482, originates from a segmentation violation in the /release-x64/otfccdump+0x65f724 component of OTFCC v0.10.4. This violation can be exploited by an attacker to cause a crash or potentially execute arbitrary code. The impact of this vulnerability is considered unimportant, but it should still be addressed to ensure the stability and security of the software.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At the moment, there is no specific workaround available for this vulnerability. Users are advised to follow the recommended fix and update their OTFCC package to a patched version.
Conclusion
In conclusion, OTFCC v0.10.4 is vulnerable to a segmentation violation (CVE-2022-35482) that can potentially lead to a crash or execution of arbitrary code. Although the impact is considered unimportant, it is recommended to update the affected package to a patched version as soon as possible. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC is a software package used for font conversion and manipulation, particularly for OpenType fonts.
The impact of CVE-2022-35482 is considered unimportant, but it can lead to a crash or potential execution of arbitrary code.
To fix this vulnerability, update your OTFCC package to a version that includes a patch for CVE-2022-35482.
Currently, there is no specific workaround available for this vulnerability. It is recommended to update the affected package.
You can find more information about CVE-2022-35482 in the provided source link: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35482.json
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
