OTFCC Buffer Overflow Vulnerability (CNVD-2023-11997)

2022-09-2100:00:00

China National Vulnerability Database

www.cnvd.org.cn

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

JSON

OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files. OTFCC suffers from a buffer overflow vulnerability that stems from the release-x64/otfccdump 0x6e41b8 commit package containing a heap buffer overflow. No detailed vulnerability details are currently available.