CVE-2022-35060: 
NixOS vulnerability analysis and mitigation

OTFCC commit 617837b contains a heap buffer overflow vulnerability identified as CVE-2022-35060. The vulnerability specifically affects the otfccdump binary and is triggered via /release-x64/otfccdump+0x6c0a32. The issue was discovered and reported on July 4, 2022 (MITRE CVE).

The vulnerability has been assigned a CVSS 3.1 base score of 6.5 (Medium severity). The attack vector is network-based with low attack complexity, requires no privileges but does need user interaction. The scope is unchanged, with no impact on confidentiality or integrity, but has a high impact on availability (Ubuntu Security).

The vulnerability primarily affects system availability through a heap buffer overflow condition. While there is no reported impact on confidentiality or integrity, the high availability impact suggests potential system crashes or service disruptions (Ubuntu Security).

Several distributions have addressed this vulnerability. In Debian, the issue is fixed in bullseye with version 2020.20200327.54578-7+deb11u2. Ubuntu has marked this as 'Not affected' for several releases including 24.04 LTS, 23.10, 22.04 LTS, and 20.04 LTS, as the vulnerable otfccdump binary is not built in these versions (Debian Security Tracker, Ubuntu Security).