7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
harfbuzz is vulnerable to arbitrary code execution. A buffer over-read in hb-ot-layout-gpos-table.hh
allows an attacker to cause a denial of service or potentially execute arbitrary code on the host OS.
lists.opensuse.org/opensuse-updates/2016-08/msg00070.html
rhn.redhat.com/errata/RHSA-2016-0072.html
www.securityfocus.com/bid/92039
www.ubuntu.com/usn/USN-3067-1
github.com/behdad/harfbuzz/commit/f96664974774bfeb237a7274f512f64aaafb201e
github.com/behdad/harfbuzz/issues/139#issuecomment-146984679
github.com/harfbuzz/harfbuzz/commit/f396fbb000dc1c8acddbf6a16e193b328c5e551e
security.gentoo.org/glsa/201701-76
7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P