hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | adoptopenjdk-upgrade-latest | Aug 11, 2023 | Feb 4, 2023 | |
| Alma_linux | alma-upgrade-harfbuzzalma-upgrade-harfbuzz-develalma-upgrade-harfbuzz-icualma-upgrade-java-11-openjdkalma-upgrade-java-11-openjdk-demoalma-upgrade-java-11-openjdk-demo-fastdebugalma-upgrade-java-11-openjdk-demo-slowdebugalma-upgrade-java-11-openjdk-develalma-upgrade-java-11-openjdk-devel-fastdebugalma-upgrade-java-11-openjdk-devel-slowdebugalma-upgrade-java-11-openjdk-fastdebugalma-upgrade-java-11-openjdk-headlessalma-upgrade-java-11-openjdk-headless-fastdebugalma-upgrade-java-11-openjdk-headless-slowdebugalma-upgrade-java-11-openjdk-javadocalma-upgrade-java-11-openjdk-javadoc-zipalma-upgrade-java-11-openjdk-jmodsalma-upgrade-java-11-openjdk-jmods-fastdebugalma-upgrade-java-11-openjdk-jmods-slowdebugalma-upgrade-java-11-openjdk-slowdebugalma-upgrade-java-11-openjdk-srcalma-upgrade-java-11-openjdk-src-fastdebugalma-upgrade-java-11-openjdk-src-slowdebugalma-upgrade-java-11-openjdk-static-libsalma-upgrade-java-11-openjdk-static-libs-fastdebugalma-upgrade-java-11-openjdk-static-libs-slowdebugalma-upgrade-java-17-openjdkalma-upgrade-java-17-openjdk-demoalma-upgrade-java-17-openjdk-demo-fastdebugalma-upgrade-java-17-openjdk-demo-slowdebugalma-upgrade-java-17-openjdk-develalma-upgrade-java-17-openjdk-devel-fastdebugalma-upgrade-java-17-openjdk-devel-slowdebugalma-upgrade-java-17-openjdk-fastdebugalma-upgrade-java-17-openjdk-headlessalma-upgrade-java-17-openjdk-headless-fastdebugalma-upgrade-java-17-openjdk-headless-slowdebugalma-upgrade-java-17-openjdk-javadocalma-upgrade-java-17-openjdk-javadoc-zipalma-upgrade-java-17-openjdk-jmodsalma-upgrade-java-17-openjdk-jmods-fastdebugalma-upgrade-java-17-openjdk-jmods-slowdebugalma-upgrade-java-17-openjdk-slowdebugalma-upgrade-java-17-openjdk-srcalma-upgrade-java-17-openjdk-src-fastdebugalma-upgrade-java-17-openjdk-src-slowdebugalma-upgrade-java-17-openjdk-static-libsalma-upgrade-java-17-openjdk-static-libs-fastdebugalma-upgrade-java-17-openjdk-static-libs-slowdebug | Jul 24, 2023 | Feb 4, 2023 | |
| Alpine Linux | alpine-linux-upgrade-openjdk11alpine-linux-upgrade-openjdk17alpine-linux-upgrade-harfbuzz | Mar 21, 2024 | Feb 4, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-harfbuzzamazon-linux-ami-2-upgrade-harfbuzz-debuginfoamazon-linux-ami-2-upgrade-harfbuzz-develamazon-linux-ami-2-upgrade-harfbuzz-icuamazon-linux-ami-2-upgrade-java-11-amazon-correttoamazon-linux-ami-2-upgrade-java-11-amazon-corretto-headlessamazon-linux-ami-2-upgrade-java-11-amazon-corretto-javadocamazon-linux-ami-2-upgrade-java-17-amazon-correttoamazon-linux-ami-2-upgrade-java-17-amazon-corretto-develamazon-linux-ami-2-upgrade-java-17-amazon-corretto-headlessamazon-linux-ami-2-upgrade-java-17-amazon-corretto-javadocamazon-linux-ami-2-upgrade-java-17-amazon-corretto-jmodsamazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Mar 7, 2023 | Feb 4, 2023 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-harfbuzzamazon-linux-2023-upgrade-harfbuzz-debuginfoamazon-linux-2023-upgrade-harfbuzz-debugsourceamazon-linux-2023-upgrade-harfbuzz-develamazon-linux-2023-upgrade-harfbuzz-devel-debuginfoamazon-linux-2023-upgrade-harfbuzz-icuamazon-linux-2023-upgrade-harfbuzz-icu-debuginfoamazon-linux-2023-upgrade-java-11-amazon-correttoamazon-linux-2023-upgrade-java-11-amazon-corretto-develamazon-linux-2023-upgrade-java-11-amazon-corretto-headlessamazon-linux-2023-upgrade-java-11-amazon-corretto-javadocamazon-linux-2023-upgrade-java-11-amazon-corretto-jmodsamazon-linux-2023-upgrade-java-17-amazon-correttoamazon-linux-2023-upgrade-java-17-amazon-corretto-develamazon-linux-2023-upgrade-java-17-amazon-corretto-headlessamazon-linux-2023-upgrade-java-17-amazon-corretto-javadocamazon-linux-2023-upgrade-java-17-amazon-corretto-jmods | Feb 17, 2025 | Feb 4, 2023 | |
| Azul Zulu | azul-zulu-jdk11azul-zulu-jdk17azul-zulu-jdk20 | Jul 25, 2023 | Feb 4, 2023 | |
| Centos_linux | — | centos-upgrade-java-11-openjdkcentos-upgrade-java-11-openjdk-debuginfocentos-upgrade-java-11-openjdk-democentos-upgrade-java-11-openjdk-develcentos-upgrade-java-11-openjdk-headlesscentos-upgrade-java-11-openjdk-javadoccentos-upgrade-java-11-openjdk-javadoc-zipcentos-upgrade-java-11-openjdk-jmodscentos-upgrade-java-11-openjdk-srccentos-upgrade-java-11-openjdk-static-libs | Jul 21, 2023 | Feb 4, 2023 |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Feb 4, 2023 | |
| Dell Powerstore Dsa2023366 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Oct 5, 2023 | |
| Eclipseadoptium | eclipseadoptium-upgrade-latest | Jun 26, 2026 | Feb 4, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-media-libs-harfbuzz | Jul 11, 2024 | Feb 4, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-harfbuzzhuawei-euleros-2_0_sp10-upgrade-harfbuzz-develhuawei-euleros-2_0_sp10-upgrade-harfbuzz-help | May 18, 2023 | Feb 4, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-harfbuzzhuawei-euleros-2_0_sp11-upgrade-harfbuzz-develhuawei-euleros-2_0_sp11-upgrade-harfbuzz-help | Jul 5, 2023 | Feb 4, 2023 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-harfbuzzhuawei-euleros-2_0_sp5-upgrade-harfbuzz-develhuawei-euleros-2_0_sp5-upgrade-harfbuzz-icu | Feb 12, 2024 | Feb 4, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-harfbuzzhuawei-euleros-2_0_sp8-upgrade-harfbuzz-develhuawei-euleros-2_0_sp8-upgrade-harfbuzz-icu | Jan 10, 2024 | Feb 4, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-harfbuzzhuawei-euleros-2_0_sp9-upgrade-harfbuzz-develhuawei-euleros-2_0_sp9-upgrade-harfbuzz-help | May 10, 2023 | Feb 4, 2023 | |
| Jre Vuln | jre-upgrade-latest | Jul 19, 2023 | Feb 4, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-harfbuzzoracle-linux-upgrade-harfbuzz-develoracle-linux-upgrade-harfbuzz-icuoracle-linux-upgrade-java-11-openjdkoracle-linux-upgrade-java-11-openjdk-demooracle-linux-upgrade-java-11-openjdk-demo-fastdebugoracle-linux-upgrade-java-11-openjdk-demo-slowdebugoracle-linux-upgrade-java-11-openjdk-develoracle-linux-upgrade-java-11-openjdk-devel-fastdebugoracle-linux-upgrade-java-11-openjdk-devel-slowdebugoracle-linux-upgrade-java-11-openjdk-fastdebugoracle-linux-upgrade-java-11-openjdk-headlessoracle-linux-upgrade-java-11-openjdk-headless-fastdebugoracle-linux-upgrade-java-11-openjdk-headless-slowdebugoracle-linux-upgrade-java-11-openjdk-javadocoracle-linux-upgrade-java-11-openjdk-javadoc-ziporacle-linux-upgrade-java-11-openjdk-jmodsoracle-linux-upgrade-java-11-openjdk-jmods-fastdebugoracle-linux-upgrade-java-11-openjdk-jmods-slowdebugoracle-linux-upgrade-java-11-openjdk-slowdebugoracle-linux-upgrade-java-11-openjdk-srcoracle-linux-upgrade-java-11-openjdk-src-fastdebugoracle-linux-upgrade-java-11-openjdk-src-slowdebugoracle-linux-upgrade-java-11-openjdk-static-libsoracle-linux-upgrade-java-11-openjdk-static-libs-fastdebugoracle-linux-upgrade-java-11-openjdk-static-libs-slowdebugoracle-linux-upgrade-java-17-openjdkoracle-linux-upgrade-java-17-openjdk-demooracle-linux-upgrade-java-17-openjdk-demo-fastdebugoracle-linux-upgrade-java-17-openjdk-demo-slowdebugoracle-linux-upgrade-java-17-openjdk-develoracle-linux-upgrade-java-17-openjdk-devel-fastdebugoracle-linux-upgrade-java-17-openjdk-devel-slowdebugoracle-linux-upgrade-java-17-openjdk-fastdebugoracle-linux-upgrade-java-17-openjdk-headlessoracle-linux-upgrade-java-17-openjdk-headless-fastdebugoracle-linux-upgrade-java-17-openjdk-headless-slowdebugoracle-linux-upgrade-java-17-openjdk-javadocoracle-linux-upgrade-java-17-openjdk-javadoc-ziporacle-linux-upgrade-java-17-openjdk-jmodsoracle-linux-upgrade-java-17-openjdk-jmods-fastdebugoracle-linux-upgrade-java-17-openjdk-jmods-slowdebugoracle-linux-upgrade-java-17-openjdk-slowdebugoracle-linux-upgrade-java-17-openjdk-srcoracle-linux-upgrade-java-17-openjdk-src-fastdebugoracle-linux-upgrade-java-17-openjdk-src-slowdebugoracle-linux-upgrade-java-17-openjdk-static-libsoracle-linux-upgrade-java-17-openjdk-static-libs-fastdebugoracle-linux-upgrade-java-17-openjdk-static-libs-slowdebug | Jul 21, 2023 | Feb 4, 2023 |
| Redhat_linux | redhat-upgrade-harfbuzzredhat-upgrade-harfbuzz-debuginforedhat-upgrade-harfbuzz-debugsourceredhat-upgrade-harfbuzz-develredhat-upgrade-harfbuzz-devel-debuginforedhat-upgrade-harfbuzz-icuredhat-upgrade-harfbuzz-icu-debuginforedhat-upgrade-java-11-openjdkredhat-upgrade-java-11-openjdk-debuginforedhat-upgrade-java-11-openjdk-debugsourceredhat-upgrade-java-11-openjdk-demoredhat-upgrade-java-11-openjdk-demo-fastdebugredhat-upgrade-java-11-openjdk-demo-slowdebugredhat-upgrade-java-11-openjdk-develredhat-upgrade-java-11-openjdk-devel-debuginforedhat-upgrade-java-11-openjdk-devel-fastdebugredhat-upgrade-java-11-openjdk-devel-fastdebug-debuginforedhat-upgrade-java-11-openjdk-devel-slowdebugredhat-upgrade-java-11-openjdk-devel-slowdebug-debuginforedhat-upgrade-java-11-openjdk-fastdebugredhat-upgrade-java-11-openjdk-fastdebug-debuginforedhat-upgrade-java-11-openjdk-headlessredhat-upgrade-java-11-openjdk-headless-debuginforedhat-upgrade-java-11-openjdk-headless-fastdebugredhat-upgrade-java-11-openjdk-headless-fastdebug-debuginforedhat-upgrade-java-11-openjdk-headless-slowdebugredhat-upgrade-java-11-openjdk-headless-slowdebug-debuginforedhat-upgrade-java-11-openjdk-javadocredhat-upgrade-java-11-openjdk-javadoc-zipredhat-upgrade-java-11-openjdk-jmodsredhat-upgrade-java-11-openjdk-jmods-fastdebugredhat-upgrade-java-11-openjdk-jmods-slowdebugredhat-upgrade-java-11-openjdk-slowdebugredhat-upgrade-java-11-openjdk-slowdebug-debuginforedhat-upgrade-java-11-openjdk-srcredhat-upgrade-java-11-openjdk-src-fastdebugredhat-upgrade-java-11-openjdk-src-slowdebugredhat-upgrade-java-11-openjdk-static-libsredhat-upgrade-java-11-openjdk-static-libs-fastdebugredhat-upgrade-java-11-openjdk-static-libs-slowdebugredhat-upgrade-java-17-openjdkredhat-upgrade-java-17-openjdk-debuginforedhat-upgrade-java-17-openjdk-debugsourceredhat-upgrade-java-17-openjdk-demoredhat-upgrade-java-17-openjdk-demo-fastdebugredhat-upgrade-java-17-openjdk-demo-slowdebugredhat-upgrade-java-17-openjdk-develredhat-upgrade-java-17-openjdk-devel-debuginforedhat-upgrade-java-17-openjdk-devel-fastdebugredhat-upgrade-java-17-openjdk-devel-fastdebug-debuginforedhat-upgrade-java-17-openjdk-devel-slowdebugredhat-upgrade-java-17-openjdk-devel-slowdebug-debuginforedhat-upgrade-java-17-openjdk-fastdebugredhat-upgrade-java-17-openjdk-fastdebug-debuginforedhat-upgrade-java-17-openjdk-headlessredhat-upgrade-java-17-openjdk-headless-debuginforedhat-upgrade-java-17-openjdk-headless-fastdebugredhat-upgrade-java-17-openjdk-headless-fastdebug-debuginforedhat-upgrade-java-17-openjdk-headless-slowdebugredhat-upgrade-java-17-openjdk-headless-slowdebug-debuginforedhat-upgrade-java-17-openjdk-javadocredhat-upgrade-java-17-openjdk-javadoc-zipredhat-upgrade-java-17-openjdk-jmodsredhat-upgrade-java-17-openjdk-jmods-fastdebugredhat-upgrade-java-17-openjdk-jmods-slowdebugredhat-upgrade-java-17-openjdk-slowdebugredhat-upgrade-java-17-openjdk-slowdebug-debuginforedhat-upgrade-java-17-openjdk-srcredhat-upgrade-java-17-openjdk-src-fastdebugredhat-upgrade-java-17-openjdk-src-slowdebugredhat-upgrade-java-17-openjdk-static-libsredhat-upgrade-java-17-openjdk-static-libs-fastdebugredhat-upgrade-java-17-openjdk-static-libs-slowdebug | Jul 21, 2023 | Feb 4, 2023 | |
| Rocky_linux | rocky-upgrade-harfbuzzrocky-upgrade-harfbuzz-debuginforocky-upgrade-harfbuzz-debugsourcerocky-upgrade-harfbuzz-develrocky-upgrade-harfbuzz-devel-debuginforocky-upgrade-harfbuzz-icurocky-upgrade-harfbuzz-icu-debuginfo | May 8, 2025 | Feb 4, 2023 | |
| Suse | — | suse-upgrade-harfbuzz-develsuse-upgrade-harfbuzz-toolssuse-upgrade-java-11-openjdksuse-upgrade-java-11-openjdk-demosuse-upgrade-java-11-openjdk-develsuse-upgrade-java-11-openjdk-headlesssuse-upgrade-java-11-openjdk-javadocsuse-upgrade-java-11-openjdk-jmodssuse-upgrade-java-11-openjdk-srcsuse-upgrade-java-17-openjdksuse-upgrade-java-17-openjdk-demosuse-upgrade-java-17-openjdk-develsuse-upgrade-java-17-openjdk-headlesssuse-upgrade-java-17-openjdk-javadocsuse-upgrade-java-17-openjdk-jmodssuse-upgrade-java-17-openjdk-srcsuse-upgrade-java-1_8_0-ibmsuse-upgrade-java-1_8_0-ibm-32bitsuse-upgrade-java-1_8_0-ibm-alsasuse-upgrade-java-1_8_0-ibm-demosuse-upgrade-java-1_8_0-ibm-develsuse-upgrade-java-1_8_0-ibm-devel-32bitsuse-upgrade-java-1_8_0-ibm-pluginsuse-upgrade-java-1_8_0-ibm-srcsuse-upgrade-libharfbuzz-gobject0suse-upgrade-libharfbuzz-gobject0-32bitsuse-upgrade-libharfbuzz-icu0suse-upgrade-libharfbuzz-icu0-32bitsuse-upgrade-libharfbuzz-subset0suse-upgrade-libharfbuzz-subset0-32bitsuse-upgrade-libharfbuzz0suse-upgrade-libharfbuzz0-32bitsuse-upgrade-typelib-1_0-harfbuzz-0_0 | Apr 13, 2023 | Feb 4, 2023 |
| Ubuntu | ubuntu-upgrade-libharfbuzz0bubuntu-upgrade-openjdk-11-jdkubuntu-upgrade-openjdk-11-jreubuntu-upgrade-openjdk-11-jre-headlessubuntu-upgrade-openjdk-11-jre-zeroubuntu-upgrade-openjdk-17-jdkubuntu-upgrade-openjdk-17-jreubuntu-upgrade-openjdk-17-jre-headlessubuntu-upgrade-openjdk-17-jre-zeroubuntu-upgrade-openjdk-20-jdkubuntu-upgrade-openjdk-20-jreubuntu-upgrade-openjdk-20-jre-headlessubuntu-upgrade-openjdk-20-jre-zeroubuntu-upgrade-openjdk-8-jdkubuntu-upgrade-openjdk-8-jreubuntu-upgrade-openjdk-8-jre-headlessubuntu-upgrade-openjdk-8-jre-zero | Aug 2, 2023 | Feb 4, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Feb 4, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub