CVE-2022-35455: 
NixOS vulnerability analysis and mitigation

OTFCC v0.10.4 was discovered to contain a heap-buffer overflow vulnerability (CVE-2022-35455). The vulnerability was identified in the /release-x64/otfccdump component and affects the software's ability to handle certain input data (Debian Security).

The vulnerability manifests as a heap-based buffer overflow in the otfccdump component. When processing certain input data, the application attempts to access memory beyond the allocated buffer boundaries, which can lead to memory corruption. The issue specifically occurs via the /release-x64/otfccdump+0x6b0d63 execution path (Debian Security).

The heap buffer overflow vulnerability could potentially lead to memory corruption and application crashes. In more severe cases, it might allow for arbitrary code execution, though this has not been explicitly confirmed in available sources (Debian Security).

The vulnerability has been confirmed to be exploitable through specially crafted input files that trigger the buffer overflow condition in the otfccdump component. The issue affects multiple versions of the software across different distributions (Debian Security).

Several Linux distributions have addressed this vulnerability through security updates. Debian has marked this as fixed in bullseye with version 2020.20200327.54578-7+deb11u2, while newer versions in bookworm, trixie, and sid remain vulnerable and await patches (Debian Security).