GLSA-202407-24 : HarfBuzz: Denial of Service

The remote host is affected by the vulnerability described in GLSA-202407-24 HarfBuzz: Denial of Service Multiple vulnerabilities have been discovered in HarfBuzz. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from t...

HarfBuzz: Denial of Service

Background HarfBuzz is an OpenType text shaping engine. Description Multiple vulnerabilities have been discovered in HarfBuzz. Please review the CVE identifiers referenced below for details. Impact hb-ot-layout-gsubgpos.hh in HarfBuzz allows attackers to trigger On^2 growth via consecutive marks...

SDL_ttf: Arbitrary Memory Write

Background SDLttf is a wrapper around the FreeType and Harfbuzz libraries, allowing you to use TrueType fonts to render text in SDL applications. Description A vulnerability has been discovered in SDLttf. Please review the CVE identifier referenced below for details. Impact SDLttf was discovered ...

OPENSUSE-SU-2024:12660-1 harfbuzz-devel-6.0.0-2.1 on GA media

These are all security issues fixed in the harfbuzz-devel-6.0.0-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12168-1 harfbuzz-devel-4.4.1-1.1 on GA media

These are all security issues fixed in the harfbuzz-devel-4.4.1-1.1 package on the GA media of openSUSE Tumbleweed...

RHEL 7 : harfbuzz (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - chromium-browser: Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6 CVE-2015-8947,...

Oracle Linux 8 : harfbuzz (ELSA-2024-2980)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2980 advisory. 1.7.5-4 - Resolves:RHEL-8400 allows attackers to trigger On^2 growth via consecutive marks Tenable has extracted the preceding description block directly from t...

harfbuzz:hb-draw-fuzzer: Crash in OT::VarComponent::get_path_at

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6610112583106560 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-draw-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5160ffe90780 Crash State:...

RHEL 8 : harfbuzz (RHSA-2024:2980)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2980 advisory. HarfBuzz is an implementation of the OpenType Layout engine. Security Fixes: harfbuzz: allows attackers to trigger On^2 growth via consecutive marks...

harfbuzz security update

1.7.5-4 - Resolves:RHEL-8400 allows attackers to trigger On^2 growth via consecutive marks...

harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks...

Moderate: Red Hat Security Advisory: harfbuzz security update

An update for harfbuzz is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CentOS 8 : harfbuzz (CESA-2024:2980)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2980 advisory. - hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base...

ALSA-2024:2980 Moderate: harfbuzz security update

HarfBuzz is an implementation of the OpenType Layout engine. Security Fixes: harfbuzz: allows attackers to trigger On^2 growth via consecutive marks CVE-2023-25193 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer...

Moderate: harfbuzz security update

HarfBuzz is an implementation of the OpenType Layout engine. Security Fixes: harfbuzz: allows attackers to trigger On^2 growth via consecutive marks CVE-2023-25193 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer...

EulerOS Virtualization 3.0.6.6 : harfbuzz (EulerOS-SA-2024-1652)

According to the versions of the harfbuzz packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the...

Huawei EulerOS: Security Advisory for harfbuzz (EulerOS-SA-2024-1652)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

harfbuzz:hb-subset-fuzzer: Heap-use-after-free in hb_subset_plan_t::hb_subset_plan_t

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6696597055406080 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x5180000006...

RHEL 7 : chromium-browser (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - chromium-browser: pointer disclosure in sqlite CVE-2017-7000 - numbers.c in libxslt before 1.1.29, as use...

RHEL 7 : harfbuzz (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - harfbuzz: allows attackers to trigger On^2 growth via consecutive marks CVE-2023-25193 Note that Nessus has not...