CVE-2022-23318: 
Linux Debian vulnerability analysis and mitigation

A heap-buffer-overflow vulnerability was discovered in pcf2bdf versions >= 1.05. The vulnerability allows an attacker to trigger unsafe memory access via a specially crafted PCF font file. This out-of-bound read may lead to an application crash, information disclosure via program memory, or other context-dependent impacts (NVD, MITRE).

The vulnerability was identified in the main function of pcf2bdf.cc around line 852, where a heap buffer overflow occurs during the processing of PCF font files. When tested with address sanitization, the vulnerability manifests as a READ operation of size 40 bytes beyond the allocated buffer boundary. The issue was confirmed through fuzzing tests using AFL, which demonstrated that specially crafted input files could trigger a memory access violation (GitHub Issue).

The vulnerability can result in multiple adverse effects including application crashes, potential information disclosure through leaked program memory, and other context-dependent impacts. The out-of-bounds read access to memory could potentially expose sensitive information from the application's memory space (NVD).

The vulnerability was fixed in version 1.07 released on February 23, 2022. Users are advised to upgrade to this version which specifically addresses CVE-2022-23318 by fixing the heap buffer overflow on invalid input PCF files (GitHub).