PT-2021-24320 · Harfbuzz · Harfbuzz

Name of the Vulnerable Software and Affected Versions: HarfBuzz version 2.9.0 Description: The issue is related to an out-of-bounds write in hb bit set invertible t::set, which is called from hb sparseset t::set and hb set copy. Recommendations: For HarfBuzz version 2.9.0, at the moment, there is...

CVE-2021-45931: Out-of-bounds Write

HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett ::set and hbsetcopy...

harfbuzz:hb-subset-fuzzer: Crash in bool OT::OffsetTo<OT::ClipBox, OT::IntType<unsigned int, 3u>, true>::serialize_c

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6254792024915968 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x62a00101714b...

harfbuzz:hb-subset-fuzzer: Crash in OT::ClipBox::copy

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6315334756335616 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerubsanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000033308f...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in OT::MathValueRecord::copy

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5891183595880448 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in OT::MathGlyphConstruction::subset

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6616166961905664 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-use-after-free in hb_resolve_overflows

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5127321313476608 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

harfbuzz:hb-shape-fuzzer: Use-of-uninitialized-value in OT::hb_ot_apply_context_t::skipping_iterator_t::prev

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5349416110784512 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-shape-fuzzer: Heap-buffer-overflow in bool OT::Lookup::sanitize<OT::PosLookupSubTable>

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5417352787787776 Project: harfbuzz Fuzzing Engine: honggfuzz Fuzz Target: hb-shape-fuzzer Job Type: honggfuzzasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

harfbuzz:hb-subset-fuzzer: Crash in hb_bit_set_invertible_t::set

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5141317848530944 Project: harfbuzz Fuzzing Engine: honggfuzz Fuzz Target: hb-subset-fuzzer Job Type: honggfuzzasanharfbuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000009b1d4...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in hb_hashmap_t<hb_serialize_context_t::object_t const*, unsigned int,

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4764515267379200 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned int, 4u> const> hb_array_t<OT::IntType<unsigned

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5443213648330752 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in trySubset

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5522792714993664 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in trySubset

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5041767803125760 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Negative-size-param in OT::VarRegionList* hb_serialize_context_t::allocate_size<OT::VarRegionList>

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5362189182566400 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Negative-size-param Crash Address: Cra...

harfbuzz:hb-subset-fuzzer: Negative-size-param in OT::VarRegionList* hb_serialize_context_t::allocate_size<OT::VarRegionList>

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6313750058631168 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Negative-size-param Crash Address: Cra...

harfbuzz:hb-shape-fuzzer: Use-of-uninitialized-value in OT::hb_ot_apply_context_t::check_glyph_property

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5061207689134080 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Denial Of Service (DoS)

harfbuzz is vulnerable to denial of service. Mishandling of GPOS and GSUB table in hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh and hb-ot-layout-gsubgpos-private.hh allows an attacker to cause a denial of service condition...

Arbitrary Code Execution

harfbuzz is vulnerable to arbitrary code execution. A buffer over-read in hb-ot-layout-gpos-table.hh allows an attacker to cause a denial of service or potentially execute arbitrary code on the host OS...

Arbitrary Code Execution

harfbuzz is vulnerable to arbitrary code execution. A buffer over-read resulting from an inverted length check in hb-ot-font.cc allows an attacker to crash the application and potentially obtain arbitrary code execution...