hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | Upgrade to the latest version of AdoptOpenJDK | Aug 11, 2023 | Feb 4, 2023 |
| Alma_linux | — | Upgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-develUpgrade java-17-openjdk-devel-fastdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade harfbuzzUpgrade java-17-openjdk-headless-fastdebugUpgrade java-17-openjdk-src-slowdebugUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-demoUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-demoUpgrade java-11-openjdk-develUpgrade java-17-openjdk-headlessUpgrade java-17-openjdkUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-src-fastdebugUpgrade harfbuzz-icuUpgrade harfbuzz-develUpgrade java-11-openjdkUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-static-libsUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-srcUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-fastdebugUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-static-libs-fastdebug | Jul 24, 2023 | Feb 4, 2023 |
| Alpine Linux | — | Upgrade openjdk11Upgrade openjdk17Upgrade harfbuzz | Mar 21, 2024 | Feb 4, 2023 |
| Amazon Linux Ami 2 | — | Upgrade java-17-amazon-correttoUpgrade java-11-amazon-corretto-javadocUpgrade java-11-amazon-corretto-headlessUpgrade thunderbirdUpgrade harfbuzz-debuginfoUpgrade java-17-amazon-corretto-jmodsUpgrade harfbuzz-develUpgrade java-17-amazon-corretto-headlessUpgrade java-17-amazon-corretto-javadocUpgrade thunderbird-debuginfoUpgrade harfbuzz-icuUpgrade harfbuzzUpgrade java-17-amazon-corretto-develUpgrade java-11-amazon-corretto | Mar 7, 2023 | Feb 4, 2023 |
| Amazon_linux_2023 | — | Upgrade java-17-amazon-corretto-headlessUpgrade harfbuzz-debuginfoUpgrade java-17-amazon-correttoUpgrade harfbuzz-devel-debuginfoUpgrade java-17-amazon-corretto-javadocUpgrade harfbuzz-icuUpgrade java-17-amazon-corretto-jmodsUpgrade java-11-amazon-corretto-javadocUpgrade java-11-amazon-corretto-headlessUpgrade java-11-amazon-corretto-jmodsUpgrade java-11-amazon-corretto-develUpgrade harfbuzz-debugsourceUpgrade harfbuzz-develUpgrade harfbuzzUpgrade java-11-amazon-correttoUpgrade harfbuzz-icu-debuginfoUpgrade java-17-amazon-corretto-devel | Feb 17, 2025 | Feb 4, 2023 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 11 installer 11.65.14 (JDK 11.0.19.0.101+2, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 20 installer 20.32.11 (JDK 20.0.2+9, PSU) (short-term support); migrate to JDK 21 (LTS)Upgrade to Azul Zulu JDK 17 installer 17.43.14 (JDK 17.0.7.0.101+2, quarterly CPU) (LTS stream) | Jul 25, 2023 | Feb 4, 2023 |
| Centos_linux | — | Upgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-srcUpgrade java-11-openjdkUpgrade java-11-openjdk-headlessUpgrade java-11-openjdk-develUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-demoUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-javadoc-zip | Jul 21, 2023 | Feb 4, 2023 |
| Debian | — | Upgrade harfbuzzNo solution exists | May 15, 2025 | Feb 4, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Feb 4, 2023 |
| Gentoo Linux | — | Upgrade media-libs/harfbuzz. | Jul 11, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade harfbuzz-develUpgrade harfbuzz-helpUpgrade harfbuzz | May 18, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade harfbuzzUpgrade harfbuzz-helpUpgrade harfbuzz-devel | Jul 5, 2023 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade harfbuzz-icuUpgrade harfbuzzUpgrade harfbuzz-devel | Feb 12, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade harfbuzzUpgrade harfbuzz-develUpgrade harfbuzz-icu | Jan 10, 2024 | Feb 4, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade harfbuzz-develUpgrade harfbuzzUpgrade harfbuzz-help | May 10, 2023 | Feb 4, 2023 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jul 19, 2023 | Feb 4, 2023 |
| Oracle_linux | — | Upgrade java-11-openjdk-srcUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-javadocUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-11-openjdkUpgrade java-17-openjdk-static-libsUpgrade java-17-openjdk-srcUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade harfbuzzUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-fastdebugUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-src-slowdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-11-openjdk-develUpgrade java-17-openjdk-src-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-headlessUpgrade harfbuzz-icuUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-javadoc-zipUpgrade java-17-openjdk-headless-fastdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-develUpgrade java-17-openjdkUpgrade java-11-openjdk-javadocUpgrade java-17-openjdk-jmods-slowdebugUpgrade harfbuzz-develUpgrade java-17-openjdk-demoUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-javadoc-zip | Jul 21, 2023 | Feb 4, 2023 |
| Redhat_linux | — | Upgrade java-11-openjdk-headless-fastdebug-debuginfoUpgrade java-17-openjdk-slowdebug-debuginfoUpgrade java-11-openjdk-fastdebug-debuginfoUpgrade java-17-openjdk-fastdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-devel-debuginfoUpgrade java-17-openjdk-devel-slowdebug-debuginfoUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-debuginfoUpgrade java-11-openjdk-headless-debuginfoUpgrade java-17-openjdk-devel-debuginfoUpgrade java-11-openjdk-demoUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-slowdebug-debuginfoUpgrade harfbuzz-devel-debuginfoUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-11-openjdkUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-devel-slowdebug-debuginfoUpgrade java-17-openjdk-static-libsUpgrade java-17-openjdk-slowdebugUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-devel-fastdebug-debuginfoUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-17-openjdk-devel-fastdebug-debuginfoUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-fastdebugUpgrade harfbuzzUpgrade java-11-openjdk-slowdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-17-openjdk-headless-debuginfoUpgrade java-17-openjdk-javadoc-zipUpgrade harfbuzz-icu-debuginfoUpgrade java-11-openjdk-javadoc-zipUpgrade harfbuzz-debuginfoUpgrade java-17-openjdk-demoUpgrade java-17-openjdk-demo-slowdebugUpgrade harfbuzz-icuUpgrade java-17-openjdk-devel-slowdebugUpgrade java-11-openjdk-develUpgrade java-17-openjdk-headless-fastdebug-debuginfoUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-headless-slowdebug-debuginfoUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-devel-fastdebugUpgrade java-17-openjdk-src-fastdebugUpgrade java-17-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-debugsourceUpgrade harfbuzz-debugsourceUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-debuginfoUpgrade java-17-openjdk-headless-fastdebugUpgrade java-17-openjdk-debugsourceUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-src-slowdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-headlessUpgrade java-17-openjdk-develUpgrade java-17-openjdk-src-slowdebugNo solution existsUpgrade harfbuzz-develUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk | Jul 21, 2023 | Feb 4, 2023 |
| Rocky_linux | — | Upgrade harfbuzz-debugsourceUpgrade harfbuzz-develUpgrade harfbuzz-icu-debuginfoUpgrade harfbuzz-devel-debuginfoUpgrade harfbuzz-icuUpgrade harfbuzzUpgrade harfbuzz-debuginfo | May 8, 2025 | Feb 4, 2023 |
| Suse | — | Upgrade java-11-openjdk-develUpgrade java-11-openjdk-jmodsUpgrade java-17-openjdk-headlessUpgrade java-1_8_0-ibm-develUpgrade libharfbuzz-gobject0Upgrade java-1_8_0-ibm-alsaUpgrade java-17-openjdk-develUpgrade libharfbuzz-subset0Upgrade typelib-1_0-harfbuzz-0_0Upgrade libharfbuzz-subset0-32bitUpgrade java-17-openjdkUpgrade java-11-openjdk-javadocUpgrade java-11-openjdk-headlessUpgrade java-1_8_0-ibm-srcUpgrade java-1_8_0-ibm-32bitUpgrade java-1_8_0-ibm-devel-32bitUpgrade java-17-openjdk-demoUpgrade java-17-openjdk-javadocUpgrade java-17-openjdk-jmodsUpgrade harfbuzz-toolsUpgrade java-11-openjdk-demoUpgrade libharfbuzz-icu0-32bitUpgrade libharfbuzz-icu0Upgrade libharfbuzz-gobject0-32bitUpgrade libharfbuzz0Upgrade java-17-openjdk-srcUpgrade java-11-openjdk-srcUpgrade harfbuzz-develUpgrade libharfbuzz0-32bitUpgrade java-1_8_0-ibm-pluginUpgrade java-11-openjdkUpgrade java-1_8_0-ibmUpgrade java-1_8_0-ibm-demo | Apr 13, 2023 | Feb 4, 2023 |
| Ubuntu | — | Upgrade openjdk-17-jdkUpgrade openjdk-8-jre-headlessUpgrade openjdk-17-jre-headlessUpgrade openjdk-17-jre-zeroUpgrade openjdk-11-jdkUpgrade openjdk-20-jreUpgrade openjdk-20-jre-headlessUpgrade openjdk-8-jreUpgrade openjdk-11-jreUpgrade openjdk-11-jre-headlessUpgrade openjdk-8-jre-zeroUpgrade openjdk-20-jdkUpgrade openjdk-17-jreUpgrade libharfbuzz0bUpgrade openjdk-8-jdkUpgrade openjdk-20-jre-zeroUpgrade openjdk-11-jre-zero | Aug 2, 2023 | Feb 4, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 4, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub