Search CVE reports
1 – 10 of 11 results
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font...
1 affected package
harfbuzz
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | Not affected | Not affected | Not affected | Not affected | Not affected |
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm...
1 affected package
harfbuzz
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | Not affected | Not affected | Not affected | Not affected | Not affected |
HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball,...
1 affected package
libharfbuzz-shaper-perl
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| libharfbuzz-shaper-perl | Needs evaluation | Not in release | Not in release | — | — |
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc...
1 affected package
harfbuzz
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | Not affected | Vulnerable | Not affected | Not affected | Not affected |
Some fixes available 5 of 8
HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
1 affected package
harfbuzz
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | Fixed | Not affected | Not affected | Not affected | Needs evaluation |
Some fixes available 21 of 26
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
13 affected packages
harfbuzz, openjdk, openjdk-8, openjdk-9, openjdk-lts...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | Not affected | Not affected | Fixed | Fixed | Needs evaluation |
| openjdk | Not in release | Not in release | Not in release | Not in release | Not in release |
| openjdk-8 | Not affected | Not affected | Not affected | Not affected | Not affected |
| openjdk-9 | Not in release | Not in release | Not in release | Not in release | Not in release |
| openjdk-lts | Fixed | Fixed | Fixed | Fixed | Fixed |
| openjdk-13 | Not in release | Not in release | Not in release | Ignored | Not in release |
| openjdk-16 | Not in release | Not in release | Not in release | Ignored | Not in release |
| openjdk-17 | Not affected | Not affected | Fixed | Fixed | Fixed |
| openjdk-18 | Not in release | Not in release | Ignored | Not in release | Not in release |
| openjdk-19 | Not in release | Not in release | Not in release | Not in release | Not in release |
| openjdk-20 | Not in release | Not in release | Not in release | Not in release | Not in release |
| openjdk-21 | Not affected | Not affected | Fixed | Fixed | Not in release |
| openjdk-22 | Not in release | — | Not in release | Not in release | Not in release |
Some fixes available 11 of 38
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
13 affected packages
harfbuzz, openjdk-8, icedtea-web, openjdk-9, openjdk-lts...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | Fixed | Fixed | Fixed | Fixed | Not affected |
| openjdk-8 | Not affected | Not affected | Not affected | Not affected | Not affected |
| icedtea-web | Not affected | Not affected | Not affected | Not affected | Not affected |
| openjdk-9 | Not in release | Not in release | Not in release | Not in release | Not in release |
| openjdk-lts | Not affected | Not affected | Not affected | Not affected | Not affected |
| openjdk-12 | Not in release | Not in release | Not in release | Not in release | Not in release |
| openjdk-13 | Not in release | Not in release | Not in release | Not affected | Not in release |
| openjdk-15 | Not in release | Not in release | Not in release | Not in release | Not in release |
| openjdk-16 | Not in release | Not in release | Not in release | Not affected | Not in release |
| openjdk-17 | Not affected | Not affected | Not affected | Not affected | Not affected |
| openjdk-18 | Not in release | Not in release | Not affected | Not in release | Not in release |
| qt6-base | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| qtwebengine-opensource-src | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).
1 affected package
harfbuzz
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | — | — | Not affected | Not affected | Not affected |
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to...
1 affected package
harfbuzz
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | — | — | Not affected | Not affected | Not affected |
Some fixes available 2 of 3
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.
1 affected package
harfbuzz
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| harfbuzz | — | — | — | — | — |