hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | — | Aug 11, 2023 | Feb 4, 2023 |
| Alma_linux | — | Upgrade java-11-openjdk-demoUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade harfbuzzUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-demoUpgrade java-17-openjdk-develUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdkUpgrade java-17-openjdk-src-fastdebugUpgrade harfbuzz-develUpgrade java-11-openjdk-headless-fastdebugUpgrade java-17-openjdk-src-slowdebugUpgrade java-11-openjdk-develUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-devel-slowdebugUpgrade harfbuzz-icuUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-static-libsUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-devel-slowdebugUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-srcUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-demo-slowdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-srcUpgrade java-11-openjdkUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-static-libs-fastdebug | Jul 24, 2023 | Feb 4, 2023 |
| Alpine Linux | — | Upgrade harfbuzzUpgrade openjdk17Upgrade openjdk11 | Mar 21, 2024 | Feb 4, 2023 |
| Amazon Linux Ami 2 | — | Upgrade java-17-amazon-corretto-develUpgrade thunderbird-debuginfoUpgrade harfbuzz-icuUpgrade java-17-amazon-corretto-javadocUpgrade harfbuzzUpgrade java-11-amazon-correttoUpgrade thunderbirdUpgrade harfbuzz-debuginfoUpgrade java-11-amazon-corretto-headlessUpgrade java-17-amazon-correttoUpgrade harfbuzz-develUpgrade java-11-amazon-corretto-javadocUpgrade java-17-amazon-corretto-headlessUpgrade java-17-amazon-corretto-jmods | Mar 7, 2023 | Feb 4, 2023 |
| Amazon_linux_2023 | — | Upgrade harfbuzz-debugsourceUpgrade java-17-amazon-corretto-develUpgrade java-11-amazon-correttoUpgrade harfbuzz-develUpgrade java-11-amazon-corretto-develUpgrade harfbuzz-icu-debuginfoUpgrade harfbuzzUpgrade java-11-amazon-corretto-javadocUpgrade java-17-amazon-corretto-jmodsUpgrade java-17-amazon-correttoUpgrade harfbuzz-devel-debuginfoUpgrade harfbuzz-debuginfoUpgrade java-17-amazon-corretto-headlessUpgrade java-17-amazon-corretto-javadocUpgrade java-11-amazon-corretto-headlessUpgrade java-11-amazon-corretto-jmodsUpgrade harfbuzz-icu | Feb 17, 2025 | Feb 4, 2023 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 11 installer 11.65.14 (JDK 11.0.19.0.101+2, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 20 installer 20.32.11 (JDK 20.0.2+9, PSU) (short-term support); migrate to JDK 21 (LTS)Upgrade to Azul Zulu JDK 17 installer 17.43.14 (JDK 17.0.7.0.101+2, quarterly CPU) (LTS stream) | Jul 25, 2023 | Feb 4, 2023 |
| Centos_linux | — | Upgrade java-11-openjdk-headlessUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-develUpgrade java-11-openjdkUpgrade java-11-openjdk-demoUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-javadoc-zip | Jul 21, 2023 | Feb 4, 2023 |
| Debian | — | Upgrade harfbuzz | May 15, 2025 | Feb 4, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Feb 4, 2023 |
| Gentoo Linux | — | Upgrade media-libs/harfbuzz. | Jul 11, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade harfbuzz-develUpgrade harfbuzz-helpUpgrade harfbuzz | May 18, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade harfbuzz-helpUpgrade harfbuzz-develUpgrade harfbuzz | Jul 5, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade harfbuzz-develUpgrade harfbuzz-icuUpgrade harfbuzz | Feb 12, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade harfbuzz-develUpgrade harfbuzzUpgrade harfbuzz-icu | Jan 10, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade harfbuzzUpgrade harfbuzz-helpUpgrade harfbuzz-devel | May 10, 2023 | Feb 4, 2023 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jul 19, 2023 | Feb 4, 2023 |
| Oracle_linux | — | Upgrade java-17-openjdk-demo-fastdebugUpgrade java-17-openjdk-devel-slowdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-jmodsUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-srcUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-static-libsUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdkUpgrade java-11-openjdk-demoUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-fastdebugUpgrade harfbuzzUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-slowdebugUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-fastdebugUpgrade java-17-openjdk-slowdebugUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-jmods-fastdebugUpgrade harfbuzz-icuUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-javadoc-zipUpgrade java-17-openjdk-src-fastdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-javadocUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-develUpgrade java-11-openjdk-demo-slowdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade harfbuzz-develUpgrade java-17-openjdk-demoUpgrade java-17-openjdk-headless-fastdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-develUpgrade java-17-openjdkUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-javadoc-zipUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-src-slowdebug | Jul 21, 2023 | Feb 4, 2023 |
| Redhat_linux | — | Upgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-devel-fastdebug-debuginfoUpgrade java-17-openjdk-srcUpgrade java-17-openjdk-debuginfoUpgrade java-11-openjdk-slowdebug-debuginfoUpgrade java-17-openjdk-slowdebugUpgrade java-11-openjdk-headless-slowdebug-debuginfoUpgrade harfbuzzUpgrade java-11-openjdk-javadocUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-devel-fastdebug-debuginfoUpgrade java-17-openjdk-devel-slowdebug-debuginfoUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-headless-fastdebug-debuginfoUpgrade java-17-openjdk-slowdebug-debuginfoUpgrade java-11-openjdk-devel-slowdebug-debuginfoUpgrade java-11-openjdk-devel-debuginfoUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdkUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-17-openjdk-jmodsUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-headless-debuginfoUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-static-libs-slowdebugUpgrade harfbuzz-devel-debuginfoUpgrade java-17-openjdk-devel-debuginfoUpgrade java-11-openjdk-fastdebug-debuginfoUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-debuginfoUpgrade java-17-openjdk-demoUpgrade java-17-openjdk-headless-slowdebug-debuginfoNo solution existsUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-src-slowdebugUpgrade harfbuzz-icuUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdkUpgrade harfbuzz-develUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-debugsourceUpgrade java-11-openjdk-devel-fastdebugUpgrade java-17-openjdk-headless-debuginfoUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-src-fastdebugUpgrade harfbuzz-icu-debuginfoUpgrade java-11-openjdk-demo-slowdebugUpgrade harfbuzz-debugsourceUpgrade harfbuzz-debuginfoUpgrade java-17-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-develUpgrade java-11-openjdk-src-fastdebugUpgrade java-17-openjdk-debugsourceUpgrade java-17-openjdk-headless-fastdebug-debuginfoUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-headless-fastdebugUpgrade java-17-openjdk-src-slowdebugUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-devel | Jul 21, 2023 | Feb 4, 2023 |
| Rocky_linux | — | Upgrade harfbuzz-icuUpgrade harfbuzzUpgrade harfbuzz-debuginfoUpgrade harfbuzz-develUpgrade harfbuzz-debugsourceUpgrade harfbuzz-devel-debuginfoUpgrade harfbuzz-icu-debuginfo | May 8, 2025 | Feb 4, 2023 |
| Suse | — | Upgrade java-11-openjdk-srcUpgrade java-11-openjdkUpgrade harfbuzz-develUpgrade java-17-openjdk-jmodsUpgrade libharfbuzz0Upgrade harfbuzz-toolsUpgrade libharfbuzz-icu0Upgrade libharfbuzz-gobject0-32bitUpgrade java-17-openjdk-srcUpgrade java-1_8_0-ibm-pluginUpgrade java-1_8_0-ibm-demoUpgrade java-11-openjdk-demoUpgrade java-1_8_0-ibmUpgrade libharfbuzz-icu0-32bitUpgrade libharfbuzz0-32bitUpgrade java-17-openjdkUpgrade libharfbuzz-subset0-32bitUpgrade java-1_8_0-ibm-alsaUpgrade java-17-openjdk-develUpgrade java-11-openjdk-headlessUpgrade java-1_8_0-ibm-srcUpgrade java-11-openjdk-develUpgrade java-11-openjdk-jmodsUpgrade java-1_8_0-ibm-develUpgrade java-11-openjdk-javadocUpgrade java-1_8_0-ibm-32bitUpgrade libharfbuzz-subset0Upgrade java-17-openjdk-javadocUpgrade java-17-openjdk-headlessUpgrade libharfbuzz-gobject0Upgrade java-17-openjdk-demoUpgrade java-1_8_0-ibm-devel-32bitUpgrade typelib-1_0-harfbuzz-0_0 | Apr 13, 2023 | Feb 4, 2023 |
| Ubuntu | — | Upgrade openjdk-8-jre-headlessUpgrade openjdk-17-jre-zeroUpgrade openjdk-11-jdkUpgrade openjdk-20-jdkUpgrade openjdk-17-jre-headlessUpgrade openjdk-20-jre-headlessUpgrade openjdk-20-jreUpgrade openjdk-8-jreUpgrade openjdk-17-jdkUpgrade openjdk-8-jre-zeroUpgrade openjdk-11-jre-headlessUpgrade openjdk-11-jreUpgrade openjdk-20-jre-zeroUpgrade openjdk-17-jreUpgrade libharfbuzz0bUpgrade openjdk-11-jre-zeroUpgrade openjdk-8-jdk | Aug 2, 2023 | Feb 4, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 4, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub