hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | Upgrade to the latest version of AdoptOpenJDK | Aug 11, 2023 | Feb 4, 2023 |
| Alma_linux | — | Upgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdkUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-fastdebugUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-devel-fastdebugUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-17-openjdk-fastdebugUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-demo-slowdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-demoUpgrade harfbuzzUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-develUpgrade java-11-openjdk-devel-slowdebugUpgrade java-17-openjdkUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-demoUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-develUpgrade java-17-openjdk-slowdebugUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-17-openjdk-src-fastdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade harfbuzz-icuUpgrade java-17-openjdk-src-slowdebugUpgrade harfbuzz-devel | Jul 24, 2023 | Feb 4, 2023 |
| Alpine Linux | — | Upgrade openjdk11Upgrade openjdk17Upgrade harfbuzz | Mar 21, 2024 | Feb 4, 2023 |
| Amazon Linux Ami 2 | — | Upgrade java-17-amazon-corretto-headlessUpgrade thunderbirdUpgrade java-17-amazon-correttoUpgrade java-11-amazon-corretto-headlessUpgrade java-11-amazon-corretto-javadocUpgrade harfbuzz-debuginfoUpgrade harfbuzz-develUpgrade java-17-amazon-corretto-jmodsUpgrade java-11-amazon-correttoUpgrade thunderbird-debuginfoUpgrade java-17-amazon-corretto-develUpgrade harfbuzz-icuUpgrade harfbuzzUpgrade java-17-amazon-corretto-javadoc | Mar 7, 2023 | Feb 4, 2023 |
| Amazon_linux_2023 | — | Upgrade harfbuzzUpgrade harfbuzz-develUpgrade harfbuzz-debugsourceUpgrade java-11-amazon-correttoUpgrade java-11-amazon-corretto-develUpgrade harfbuzz-icu-debuginfoUpgrade java-17-amazon-corretto-develUpgrade java-11-amazon-corretto-jmodsUpgrade java-11-amazon-corretto-headlessUpgrade harfbuzz-icuUpgrade java-11-amazon-corretto-javadocUpgrade harfbuzz-debuginfoUpgrade java-17-amazon-corretto-javadocUpgrade java-17-amazon-corretto-headlessUpgrade java-17-amazon-correttoUpgrade harfbuzz-devel-debuginfoUpgrade java-17-amazon-corretto-jmods | Feb 17, 2025 | Feb 4, 2023 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 11 installer 11.65.14 (JDK 11.0.19.0.101+2, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 20 installer 20.32.11 (JDK 20.0.2+9, PSU) (short-term support); migrate to JDK 21 (LTS)Upgrade to Azul Zulu JDK 17 installer 17.43.14 (JDK 17.0.7.0.101+2, quarterly CPU) (LTS stream) | Jul 25, 2023 | Feb 4, 2023 |
| Centos_linux | — | Upgrade java-11-openjdk-develUpgrade java-11-openjdkUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-demoUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-javadoc-zip | Jul 21, 2023 | Feb 4, 2023 |
| Debian | — | Upgrade harfbuzzNo solution exists | May 15, 2025 | Feb 4, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Feb 4, 2023 |
| Gentoo Linux | — | Upgrade media-libs/harfbuzz. | Jul 11, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade harfbuzz-develUpgrade harfbuzz-helpUpgrade harfbuzz | May 18, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade harfbuzzUpgrade harfbuzz-helpUpgrade harfbuzz-devel | Jul 5, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade harfbuzz-develUpgrade harfbuzzUpgrade harfbuzz-icu | Feb 12, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade harfbuzzUpgrade harfbuzz-develUpgrade harfbuzz-icu | Jan 10, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade harfbuzz-develUpgrade harfbuzz-helpUpgrade harfbuzz | May 10, 2023 | Feb 4, 2023 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jul 19, 2023 | Feb 4, 2023 |
| Oracle_linux | — | Upgrade java-17-openjdk-src-fastdebugUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-headless-slowdebugUpgrade harfbuzz-icuUpgrade java-11-openjdk-javadoc-zipUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-src-slowdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdkUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-develUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-develUpgrade java-17-openjdk-demoUpgrade harfbuzz-develUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-jmodsUpgrade java-11-openjdk-srcUpgrade harfbuzzUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdkUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-fastdebug | Jul 21, 2023 | Feb 4, 2023 |
| Redhat_linux | — | Upgrade java-11-openjdkUpgrade java-17-openjdk-debuginfoUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-devel-debuginfoUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-headless-debuginfoUpgrade harfbuzz-devel-debuginfoUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-demo-fastdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-17-openjdk-devel-debuginfoUpgrade java-11-openjdk-devel-slowdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-devel-fastdebug-debuginfoUpgrade java-11-openjdk-slowdebugUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-fastdebug-debuginfoUpgrade java-17-openjdk-devel-slowdebug-debuginfoUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-devel-slowdebug-debuginfoUpgrade java-11-openjdk-devel-fastdebug-debuginfoUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-slowdebug-debuginfoUpgrade java-17-openjdk-slowdebug-debuginfoUpgrade java-11-openjdk-headless-fastdebug-debuginfoUpgrade java-17-openjdk-slowdebugUpgrade harfbuzzUpgrade java-17-openjdk-demoUpgrade java-17-openjdk-headless-slowdebug-debuginfoUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-src-slowdebugUpgrade java-11-openjdk-debugsourceUpgrade java-17-openjdk-debugsourceUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-develUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-17-openjdk-headless-fastdebug-debuginfoUpgrade java-11-openjdk-javadoc-zipUpgrade harfbuzz-debuginfoUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-headless-debuginfoUpgrade java-11-openjdk-debuginfoUpgrade harfbuzz-icuUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-devel-slowdebugUpgrade java-17-openjdkUpgrade harfbuzz-develUpgrade java-17-openjdk-develNo solution existsUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-17-openjdk-fastdebug-debuginfoUpgrade harfbuzz-debugsourceUpgrade java-17-openjdk-src-fastdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade harfbuzz-icu-debuginfoUpgrade java-11-openjdk-devel-fastdebug | Jul 21, 2023 | Feb 4, 2023 |
| Rocky_linux | — | Upgrade harfbuzz-develUpgrade harfbuzz-devel-debuginfoUpgrade harfbuzz-debugsourceUpgrade harfbuzz-icu-debuginfoUpgrade harfbuzzUpgrade harfbuzz-icuUpgrade harfbuzz-debuginfo | May 8, 2025 | Feb 4, 2023 |
| Suse | — | Upgrade java-17-openjdk-headlessUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-demoUpgrade java-1_8_0-ibm-32bitUpgrade java-1_8_0-ibm-devel-32bitUpgrade java-17-openjdkUpgrade libharfbuzz-subset0-32bitUpgrade typelib-1_0-harfbuzz-0_0Upgrade libharfbuzz-subset0Upgrade java-11-openjdk-develUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-javadocUpgrade libharfbuzz-gobject0Upgrade java-1_8_0-ibm-alsaUpgrade java-17-openjdk-develUpgrade java-1_8_0-ibm-develUpgrade java-11-openjdk-headlessUpgrade java-1_8_0-ibm-srcUpgrade java-11-openjdkUpgrade harfbuzz-develUpgrade libharfbuzz0Upgrade java-1_8_0-ibm-pluginUpgrade java-17-openjdk-srcUpgrade libharfbuzz-icu0Upgrade libharfbuzz-gobject0-32bitUpgrade harfbuzz-toolsUpgrade libharfbuzz0-32bitUpgrade java-11-openjdk-demoUpgrade libharfbuzz-icu0-32bitUpgrade java-1_8_0-ibmUpgrade java-1_8_0-ibm-demoUpgrade java-17-openjdk-jmodsUpgrade java-11-openjdk-src | Apr 13, 2023 | Feb 4, 2023 |
| Ubuntu | — | Upgrade openjdk-20-jreUpgrade openjdk-8-jreUpgrade openjdk-20-jre-headlessUpgrade openjdk-11-jdkUpgrade openjdk-17-jre-zeroUpgrade openjdk-8-jre-zeroUpgrade openjdk-11-jreUpgrade openjdk-11-jre-headlessUpgrade openjdk-8-jre-headlessUpgrade openjdk-17-jdkUpgrade openjdk-20-jdkUpgrade openjdk-17-jre-headlessUpgrade openjdk-17-jreUpgrade openjdk-8-jdkUpgrade openjdk-11-jre-zeroUpgrade openjdk-20-jre-zeroUpgrade libharfbuzz0b | Aug 2, 2023 | Feb 4, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 4, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub