CVE-2022-35463: 
NixOS vulnerability analysis and mitigation

OTFCC v0.10.4 contains a heap-buffer overflow vulnerability identified as CVE-2022-35463. The vulnerability was discovered in the /release-x64/otfccdump+0x6b0478 component. The issue was reported on July 11, 2022, and affects the texlive-bin package across multiple Debian distributions (Debian Tracker).

The vulnerability is characterized as a heap-buffer overflow condition that occurs in the otfccdump component. The issue manifests when processing certain input files, leading to memory corruption through buffer overflow. The vulnerability affects the memory handling mechanisms in OTFCC v0.10.4, specifically in the execution path involving /release-x64/otfccdump+0x6b0478 (MITRE CVE).

The heap-buffer overflow vulnerability could potentially lead to memory corruption and program crashes. While the immediate impact appears to be limited to denial of service through application crashes, heap buffer overflows can potentially lead to arbitrary code execution in some cases (Debian Tracker).

The vulnerability has been fixed in several Debian distributions. For the bullseye distribution, the fix is included in version 2020.20200327.54578-7+deb11u2. However, the vulnerability remains present in bookworm (2022.20220321.62855-5.1+deb12u2), trixie (2024.20240313.70630+ds-5), and sid (2024.20240313.70630+ds-6) distributions (Debian Tracker).