Ubuntu 24.10 : HarfBuzz vulnerability (USN-7214-1)

The remote Ubuntu 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7214-1 advisory. It was discovered that HarfBuzz incorrecty handled certain memory operations. A remote attacker could use this issue to cause HarfBuzz to crash, resulting in a denial...

USN-7214-1: HarfBuzz vulnerability

It was discovered that HarfBuzz incorrecty handled certain memory operations. A remote attacker could use this issue to cause HarfBuzz to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2024-56732

CVE-2024-56732 affects HarfBuzz 8.5.0–10.0.1 with a heap-based buffer overflow in hb_cairo_glyphs_from_buffer. Multiple Nessus/Amazon/Linux advisories corroborate the issue across distributions. No explicit exploit details or fixed version are provided in the connected docs; remediation requires ...

CVE-2024-56732

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hbcairoglyphsfrombuffer function...

Amazon Linux 2022 : harfbuzz, harfbuzz-devel, harfbuzz-icu (ALAS2022-2022-027)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-027 advisory. HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett::set and hbsetcopy. CVE-2021-45931 Tenable has extracted the preceding description block directly from the...

harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks...

SUSE-SU-2023:1822-1 Security update for harfbuzz

This update for harfbuzz fixes the following issues: - CVE-2023-25193: Fixed vulnerability that allowed attackers to trigger On^2 growth via consecutive marks bsc1207922...

SUSE-SU-2023:1821-1 Security update for harfbuzz

This update for harfbuzz fixes the following issues: - CVE-2023-25193: Fixed vulnerability that allowed attackers to trigger On^2 growth via consecutive marks bsc1207922...

USN-5746-1 harfbuzz vulnerability

Behzad Najjarpour Jabbari discovered that HarfBuzz incorrectly handled certain inputs. A remote attacker could possibly use this issue to cause a denial of service...

Ubuntu 16.04 ESM : HarfBuzz vulnerability (USN-5746-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5746-1 advisory. Behzad Najjarpour Jabbari discovered that HarfBuzz incorrectly handled certain inputs. A remote attacker could possibly use this issue to cause a denial of servic...

RHEL 9 : harfbuzz (RHSA-2022:8384)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8384 advisory. HarfBuzz is an implementation of the OpenType Layout engine. Security Fixes: harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc...

OPENSUSE-SU-2022:2663-1 Security update for harfbuzz

This update for harfbuzz fixes the following issues: - CVE-2022-33068: Fixed a integer overflow in hb-ot-shape-fallback.cc bsc1200900...

USN-5524-1 harfbuzz vulnerability

It was discovered that HarfBuzz incorrectly handled certain glyph sizes. A remote attacker could use this issue to cause HarfBuzz to crash, resulting in a denial of service...

Arbitrary Code Execution

harfbuzz is vulnerable to arbitrary code execution. A buffer over-read in hb-ot-layout-gpos-table.hh allows an attacker to cause a denial of service or potentially execute arbitrary code on the host OS...

UBUNTU-CVE-2015-9274

HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service invalid read of two bytes and application crash because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh...

CVE-2015-8947

HarfBuzz vulnerability CVE-2015-8947 affects the text shaping engine, specifically the file hb-ot-layout-gpos-table.hh. Affected product/version: HarfBuzz prior to 1.0.5. Root cause: a buffer over-read in the OpenType layout processing path when handling crafted data. Impact: remote attacker coul...

Google Chrome HarfBuzz Denial of Service Vulnerability

Google Chrome is a web browser developed by Google Inc. HarfBuzz is one of the open source text opentype layout engine. A security vulnerability exists in HarfBuzz versions prior to 1.0.6 used in Google Chrome versions prior to 48.0.2564.82. An attacker could exploit this vulnerability to cause a...

CVE-2016-2052

HarfBuzz contains CVE-2016-2052: a buffer over-read due to an inverted length check in hb-ot-font.cc, affecting HarfBuzz up to 1.0.6 and used by Google Chrome prior to 48.0.2564.82. Affected data could cause a denial of service or other impact. The issue is fixed in HarfBuzz 1.0.6 and later; upgr...

UBUNTU-CVE-2016-2052

Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc,...

CVE-2011-0064

The hbbufferensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash or possibly execute arbitrary...