Segmentation Violation in OTFCC v0.10.4
Summary
CVE-2022-35485: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969. Affects texlive-bin versions < 3a9d42668f45387fa566845be5a3e61579823d35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OTFCC v0.10.4 is a software package used for font conversion and manipulation. It is commonly used in the Debian ecosystem, specifically in the texlive-bin package. The package provides various tools for working with fonts in the TeX document preparation system. However, a vulnerability has been discovered in OTFCC v0.10.4 that can lead to a segmentation violation.
Vulnerability Detail
The vulnerability, identified as CVE-2022-35485, originates from a segmentation violation in the /release-x64/otfccdump+0x703969 function of OTFCC v0.10.4. This violation can be triggered under certain conditions, potentially leading to a crash or other unexpected behavior. The impact of this vulnerability is considered unimportant, with a CVSSv3 score of 6.5. However, it is still important to address this issue to ensure the stability and security of systems using the affected package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is recommended to follow the fix instructions provided and update the texlive-bin package to address the issue.
Conclusion
In conclusion, OTFCC v0.10.4 in the texlive-bin package has been found to have a segmentation violation vulnerability. While the impact is considered unimportant, it is still crucial to update the package to mitigate any potential risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for texlive-bin →
FAQ
OTFCC v0.10.4 is a software package used for font conversion and manipulation in the TeX document preparation system.
texlive-bin is a package in the Debian ecosystem that provides various tools for working with fonts in the TeX document preparation system.
A segmentation violation, also known as a segmentation fault, occurs when a program tries to access a memory location that it is not allowed to access. This can lead to crashes or other unexpected behavior.
The impact of this vulnerability is considered unimportant, with a CVSSv3 score of 6.5. However, it is still important to address this issue to ensure the stability and security of systems using the affected package.
To fix this vulnerability, it is recommended to update the texlive-bin package to a version that includes a patched version of OTFCC. The Debian ecosystem provides updates for texlive-bin, so users should ensure they have the latest version installed.
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
