CVE-2022-35062: 
NixOS vulnerability analysis and mitigation

OTFCC commit 617837b contains a heap buffer overflow vulnerability via /release-x64/otfccdump+0x6c0bc3. The vulnerability was assigned CVE-2022-35062 and was published on September 19, 2022. The affected software is OTFCC, a tool for manipulating OpenType font files (NVD).

The vulnerability is classified as a heap-based buffer overflow (CWE-787: Out-of-bounds Write). The CVSS v3.1 base score is 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating that the vulnerability is network accessible, requires low attack complexity, needs no privileges, but requires user interaction (NVD).

The vulnerability affects the availability of the system, as indicated by the CVSS metrics showing high impact on availability (A:H) but no impact on confidentiality (C:N) or integrity (I:N). This suggests that successful exploitation could lead to system crashes or service disruption (NVD).

The vulnerability affects multiple versions of the texlive-bin package in various distributions. In Debian, the vulnerability is fixed in bullseye version 2020.20200327.54578-7+deb11u2, while bookworm, trixie, and sid versions remain vulnerable (Debian Tracker).