hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | Upgrade to the latest version of AdoptOpenJDK | Aug 11, 2023 | Feb 4, 2023 |
| Alma_linux | — | Upgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-src-slowdebugUpgrade java-11-openjdk-fastdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdkUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-demoUpgrade java-17-openjdkUpgrade harfbuzz-icuUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-src-slowdebugUpgrade java-11-openjdk-develUpgrade java-11-openjdk-slowdebugUpgrade harfbuzz-develUpgrade harfbuzzUpgrade java-17-openjdk-develUpgrade java-11-openjdk-devel-slowdebugUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-17-openjdk-src-fastdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-demoUpgrade java-17-openjdk-devel-fastdebug | Jul 24, 2023 | Feb 4, 2023 |
| Alpine Linux | — | Upgrade openjdk17Upgrade openjdk11Upgrade harfbuzz | Mar 21, 2024 | Feb 4, 2023 |
| Amazon Linux Ami 2 | — | Upgrade java-17-amazon-corretto-headlessUpgrade thunderbirdUpgrade harfbuzz-develUpgrade java-17-amazon-corretto-jmodsUpgrade java-11-amazon-corretto-headlessUpgrade harfbuzz-debuginfoUpgrade java-17-amazon-correttoUpgrade java-11-amazon-corretto-javadocUpgrade java-17-amazon-corretto-develUpgrade java-17-amazon-corretto-javadocUpgrade java-11-amazon-correttoUpgrade harfbuzzUpgrade harfbuzz-icuUpgrade thunderbird-debuginfo | Mar 7, 2023 | Feb 4, 2023 |
| Amazon_linux_2023 | — | Upgrade harfbuzz-debuginfoUpgrade java-11-amazon-corretto-jmodsUpgrade java-11-amazon-corretto-javadocUpgrade java-11-amazon-corretto-headlessUpgrade harfbuzz-devel-debuginfoUpgrade java-17-amazon-correttoUpgrade java-17-amazon-corretto-javadocUpgrade harfbuzz-icuUpgrade java-17-amazon-corretto-headlessUpgrade java-17-amazon-corretto-jmodsUpgrade java-11-amazon-correttoUpgrade harfbuzz-debugsourceUpgrade java-17-amazon-corretto-develUpgrade harfbuzz-develUpgrade harfbuzz-icu-debuginfoUpgrade harfbuzzUpgrade java-11-amazon-corretto-devel | Feb 17, 2025 | Feb 4, 2023 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 11 installer 11.65.14 (JDK 11.0.19.0.101+2, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.43.14 (JDK 17.0.7.0.101+2, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 20 installer 20.32.11 (JDK 20.0.2+9, PSU) (short-term support); migrate to JDK 21 (LTS) | Jul 25, 2023 | Feb 4, 2023 |
| Centos_linux | — | Upgrade java-11-openjdk-javadocUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-develUpgrade java-11-openjdk-srcUpgrade java-11-openjdkUpgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-demo | Jul 21, 2023 | Feb 4, 2023 |
| Debian | — | Upgrade harfbuzzNo solution exists | May 15, 2025 | Feb 4, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Feb 4, 2023 |
| Gentoo Linux | — | Upgrade media-libs/harfbuzz. | Jul 11, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade harfbuzz-helpUpgrade harfbuzz-develUpgrade harfbuzz | May 18, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade harfbuzz-helpUpgrade harfbuzz-develUpgrade harfbuzz | Jul 5, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade harfbuzz-icuUpgrade harfbuzzUpgrade harfbuzz-devel | Feb 12, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade harfbuzz-develUpgrade harfbuzzUpgrade harfbuzz-icu | Jan 10, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade harfbuzzUpgrade harfbuzz-helpUpgrade harfbuzz-devel | May 10, 2023 | Feb 4, 2023 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jul 19, 2023 | Feb 4, 2023 |
| Oracle_linux | — | Upgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdkUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-devel-fastdebugUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-demo-fastdebugUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-17-openjdk-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-devel-slowdebugUpgrade java-17-openjdk-jmodsUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade harfbuzzUpgrade java-17-openjdk-src-slowdebugUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-src-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-headlessUpgrade harfbuzz-icuUpgrade java-17-openjdk-demoUpgrade harfbuzz-develUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdkUpgrade java-17-openjdk-develUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-develUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-11-openjdk-javadoc | Jul 21, 2023 | Feb 4, 2023 |
| Redhat_linux | — | No solution existsUpgrade java-11-openjdk-devel-fastdebugUpgrade java-17-openjdkUpgrade harfbuzz-develUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-develUpgrade java-11-openjdk-javadoc-zipUpgrade java-17-openjdk-debugsourceUpgrade java-11-openjdk-headless-slowdebugUpgrade java-17-openjdk-demoUpgrade java-11-openjdk-debugsourceUpgrade java-11-openjdk-src-fastdebugUpgrade java-17-openjdk-src-fastdebugUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-17-openjdk-headless-fastdebugUpgrade harfbuzz-icuUpgrade harfbuzz-debuginfoUpgrade java-11-openjdk-jmodsUpgrade harfbuzz-debugsourceUpgrade java-17-openjdk-src-slowdebugUpgrade harfbuzz-icu-debuginfoUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-headless-debuginfoUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-fastdebug-debuginfoUpgrade java-17-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-headless-fastdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-headless-fastdebug-debuginfoUpgrade java-11-openjdk-develUpgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-11-openjdk-devel-slowdebug-debuginfoUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-headless-debuginfoUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-fastdebugUpgrade java-17-openjdk-slowdebug-debuginfoUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-fastdebug-debuginfoUpgrade java-17-openjdk-devel-fastdebug-debuginfoUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-slowdebugUpgrade java-11-openjdk-slowdebug-debuginfoUpgrade harfbuzzUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-devel-debuginfoUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-debuginfoUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-demoUpgrade harfbuzz-devel-debuginfoUpgrade java-17-openjdk-devel-slowdebug-debuginfoUpgrade java-11-openjdk-headless-fastdebug-debuginfoUpgrade java-17-openjdk-static-libsUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-devel-fastdebug-debuginfoUpgrade java-11-openjdkUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-devel-debuginfoUpgrade java-17-openjdk-fastdebug | Jul 21, 2023 | Feb 4, 2023 |
| Rocky_linux | — | Upgrade harfbuzzUpgrade harfbuzz-debuginfoUpgrade harfbuzz-icuUpgrade harfbuzz-icu-debuginfoUpgrade harfbuzz-develUpgrade harfbuzz-debugsourceUpgrade harfbuzz-devel-debuginfo | May 8, 2025 | Feb 4, 2023 |
| Suse | — | Upgrade typelib-1_0-harfbuzz-0_0Upgrade libharfbuzz-subset0-32bitUpgrade java-1_8_0-ibm-develUpgrade java-1_8_0-ibm-devel-32bitUpgrade java-17-openjdkUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-demoUpgrade libharfbuzz-subset0Upgrade libharfbuzz-gobject0Upgrade java-1_8_0-ibm-alsaUpgrade java-11-openjdk-develUpgrade java-1_8_0-ibm-srcUpgrade java-17-openjdk-headlessUpgrade java-1_8_0-ibm-32bitUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-develUpgrade java-1_8_0-ibm-pluginUpgrade java-11-openjdk-srcUpgrade java-11-openjdkUpgrade libharfbuzz0-32bitUpgrade harfbuzz-develUpgrade java-1_8_0-ibmUpgrade java-17-openjdk-srcUpgrade harfbuzz-toolsUpgrade libharfbuzz-icu0Upgrade libharfbuzz-gobject0-32bitUpgrade libharfbuzz0Upgrade libharfbuzz-icu0-32bitUpgrade java-17-openjdk-jmodsUpgrade java-11-openjdk-demoUpgrade java-1_8_0-ibm-demo | Apr 13, 2023 | Feb 4, 2023 |
| Ubuntu | — | Upgrade openjdk-17-jre-zeroUpgrade openjdk-8-jre-headlessUpgrade openjdk-11-jreUpgrade openjdk-11-jre-headlessUpgrade openjdk-17-jre-headlessUpgrade openjdk-17-jdkUpgrade openjdk-20-jre-headlessUpgrade openjdk-20-jdkUpgrade openjdk-8-jreUpgrade openjdk-11-jdkUpgrade openjdk-20-jreUpgrade openjdk-8-jre-zeroUpgrade openjdk-17-jreUpgrade openjdk-20-jre-zeroUpgrade libharfbuzz0bUpgrade openjdk-11-jre-zeroUpgrade openjdk-8-jdk | Aug 2, 2023 | Feb 4, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 4, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub