CVE-2022-35478: 
NixOS vulnerability analysis and mitigation

OTFCC v0.10.4 was discovered to contain a segmentation violation vulnerability (CVE-2022-35478) via /release-x64/otfccdump+0x6babea. This vulnerability affects the texlive-bin package across multiple Debian distributions (Debian Security).

The vulnerability manifests as a segmentation violation in the OTFCC software package, specifically in the otfccdump component. The issue occurs at memory address /release-x64/otfccdump+0x6babea. The vulnerability has been confirmed to affect version 0.10.4 of OTFCC (Debian Security).

The vulnerability affects multiple versions of the texlive-bin package across different Debian distributions, including bookworm, trixie, and sid. While the vulnerability is present in these versions, it has been fixed in the bullseye distribution (Debian Security).

The vulnerability is triggered through the otfccdump component, which can lead to a segmentation violation when processing certain input. The crash occurs in the CLI tool, though it has been noted to have no security impact in some configurations (Debian Security).

The vulnerability has been fixed in certain distributions, specifically in Debian bullseye with version 2020.20200327.54578-7+deb11u2. However, it remains vulnerable in bookworm (2022.20220321.62855-5.1+deb12u2), trixie (2024.20240313.70630+ds-5), and sid (2024.20240313.70630+ds-6) distributions (Debian Security).