hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | — | Aug 11, 2023 | Feb 4, 2023 |
| Alma_linux | — | Upgrade java-11-openjdk-jmods-fastdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-17-openjdk-src-slowdebugUpgrade harfbuzz-develUpgrade harfbuzzUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-demoUpgrade java-17-openjdkUpgrade java-17-openjdk-src-fastdebugUpgrade harfbuzz-icuUpgrade java-11-openjdk-headless-slowdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-17-openjdk-develUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-develUpgrade java-17-openjdk-slowdebugUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-devel-slowdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-11-openjdk-slowdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-static-libsUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdkUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-11-openjdk-javadocUpgrade java-17-openjdk-jmods | Jul 24, 2023 | Feb 4, 2023 |
| Alpine Linux | — | Upgrade openjdk11Upgrade openjdk17Upgrade harfbuzz | Mar 21, 2024 | Feb 4, 2023 |
| Amazon Linux Ami 2 | — | Upgrade java-11-amazon-corretto-javadocUpgrade java-17-amazon-correttoUpgrade harfbuzz-develUpgrade java-17-amazon-corretto-headlessUpgrade java-17-amazon-corretto-jmodsUpgrade java-11-amazon-corretto-headlessUpgrade harfbuzz-debuginfoUpgrade thunderbirdUpgrade java-17-amazon-corretto-develUpgrade java-11-amazon-correttoUpgrade harfbuzz-icuUpgrade harfbuzzUpgrade thunderbird-debuginfoUpgrade java-17-amazon-corretto-javadoc | Mar 7, 2023 | Feb 4, 2023 |
| Amazon_linux_2023 | — | Upgrade java-17-amazon-corretto-headlessUpgrade java-11-amazon-corretto-jmodsUpgrade harfbuzz-debuginfoUpgrade java-17-amazon-correttoUpgrade harfbuzz-devel-debuginfoUpgrade java-11-amazon-corretto-headlessUpgrade java-17-amazon-corretto-javadocUpgrade java-11-amazon-corretto-javadocUpgrade java-17-amazon-corretto-jmodsUpgrade harfbuzz-icuUpgrade harfbuzz-develUpgrade java-17-amazon-corretto-develUpgrade harfbuzz-icu-debuginfoUpgrade harfbuzzUpgrade java-11-amazon-correttoUpgrade java-11-amazon-corretto-develUpgrade harfbuzz-debugsource | Feb 17, 2025 | Feb 4, 2023 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 17 installer 17.43.14 (JDK 17.0.7.0.101+2, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 20 installer 20.32.11 (JDK 20.0.2+9, PSU) (short-term support); migrate to JDK 21 (LTS)Upgrade to Azul Zulu JDK 11 installer 11.65.14 (JDK 11.0.19.0.101+2, quarterly CPU) (LTS stream) | Jul 25, 2023 | Feb 4, 2023 |
| Centos_linux | — | Upgrade java-11-openjdkUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-develUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-demo | Jul 21, 2023 | Feb 4, 2023 |
| Debian | — | Upgrade harfbuzz | May 15, 2025 | Feb 4, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Feb 4, 2023 |
| Gentoo Linux | — | Upgrade media-libs/harfbuzz. | Jul 11, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade harfbuzzUpgrade harfbuzz-helpUpgrade harfbuzz-devel | May 18, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade harfbuzzUpgrade harfbuzz-develUpgrade harfbuzz-help | Jul 5, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade harfbuzz-develUpgrade harfbuzz-icuUpgrade harfbuzz | Feb 12, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade harfbuzzUpgrade harfbuzz-develUpgrade harfbuzz-icu | Jan 10, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade harfbuzzUpgrade harfbuzz-develUpgrade harfbuzz-help | May 10, 2023 | Feb 4, 2023 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jul 19, 2023 | Feb 4, 2023 |
| Oracle_linux | — | Upgrade java-17-openjdk-srcUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-devel-slowdebugUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-devel-slowdebugUpgrade java-17-openjdk-slowdebugUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-devel-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdkUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-static-libs-fastdebugUpgrade harfbuzzUpgrade harfbuzz-icuUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-demoUpgrade harfbuzz-develUpgrade java-11-openjdk-src-slowdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-headless-fastdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-develUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-17-openjdk-headless-fastdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-develUpgrade java-17-openjdkUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-src-slowdebugUpgrade java-17-openjdk-src-fastdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-javadoc-zip | Jul 21, 2023 | Feb 4, 2023 |
| Redhat_linux | — | Upgrade java-11-openjdk-devel-slowdebug-debuginfoUpgrade harfbuzzUpgrade java-11-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-javadocUpgrade java-17-openjdk-devel-fastdebug-debuginfoUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-17-openjdk-slowdebug-debuginfoUpgrade harfbuzz-devel-debuginfoUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-devel-slowdebug-debuginfoUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-demo-fastdebugUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-slowdebugUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-devel-debuginfoUpgrade java-11-openjdk-slowdebug-debuginfoUpgrade java-11-openjdk-headless-debuginfoUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-devel-debuginfoUpgrade java-17-openjdk-debuginfoUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdkUpgrade java-11-openjdk-devel-fastdebug-debuginfoUpgrade java-11-openjdk-headless-fastdebug-debuginfoUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-headless-slowdebug-debuginfoUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdkUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-demo-slowdebugUpgrade harfbuzz-develNo solution existsUpgrade java-11-openjdk-develUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-debugsourceUpgrade java-17-openjdk-headless-debuginfoUpgrade java-11-openjdk-src-fastdebugUpgrade harfbuzz-debugsourceUpgrade java-17-openjdk-headless-fastdebug-debuginfoUpgrade harfbuzz-icu-debuginfoUpgrade java-17-openjdk-devel-slowdebugUpgrade harfbuzz-debuginfoUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-src-fastdebugUpgrade harfbuzz-icuUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-demoUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-src-slowdebugUpgrade java-17-openjdk-develUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade java-17-openjdk-debugsourceUpgrade java-11-openjdk-javadoc-zip | Jul 21, 2023 | Feb 4, 2023 |
| Rocky_linux | — | Upgrade harfbuzz-debuginfoUpgrade harfbuzz-icuUpgrade harfbuzzUpgrade harfbuzz-debugsourceUpgrade harfbuzz-develUpgrade harfbuzz-devel-debuginfoUpgrade harfbuzz-icu-debuginfo | May 8, 2025 | Feb 4, 2023 |
| Suse | — | Upgrade typelib-1_0-harfbuzz-0_0Upgrade java-17-openjdk-javadocUpgrade java-17-openjdkUpgrade java-1_8_0-ibm-devel-32bitUpgrade java-17-openjdk-headlessUpgrade libharfbuzz-subset0-32bitUpgrade libharfbuzz-subset0Upgrade java-11-openjdk-develUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-develUpgrade libharfbuzz-gobject0Upgrade java-1_8_0-ibm-develUpgrade java-1_8_0-ibm-32bitUpgrade java-17-openjdk-demoUpgrade java-11-openjdk-javadocUpgrade java-1_8_0-ibm-srcUpgrade java-1_8_0-ibm-alsaUpgrade java-17-openjdk-jmodsUpgrade java-1_8_0-ibmUpgrade libharfbuzz-icu0-32bitUpgrade libharfbuzz-gobject0-32bitUpgrade java-11-openjdk-demoUpgrade java-1_8_0-ibm-demoUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-srcUpgrade java-11-openjdkUpgrade java-1_8_0-ibm-pluginUpgrade libharfbuzz0-32bitUpgrade harfbuzz-develUpgrade libharfbuzz0Upgrade harfbuzz-toolsUpgrade libharfbuzz-icu0 | Apr 13, 2023 | Feb 4, 2023 |
| Ubuntu | — | Upgrade openjdk-20-jreUpgrade openjdk-8-jre-zeroUpgrade openjdk-11-jdkUpgrade openjdk-17-jre-headlessUpgrade openjdk-11-jre-headlessUpgrade openjdk-20-jdkUpgrade openjdk-8-jre-headlessUpgrade openjdk-20-jre-headlessUpgrade openjdk-8-jreUpgrade openjdk-17-jdkUpgrade openjdk-17-jre-zeroUpgrade openjdk-11-jreUpgrade openjdk-8-jdkUpgrade libharfbuzz0bUpgrade openjdk-11-jre-zeroUpgrade openjdk-17-jreUpgrade openjdk-20-jre-zero | Aug 2, 2023 | Feb 4, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 4, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub