CVE-2023-25193 — Allocation of Resources Without Limits or Throttling in Harfbuzz

CWE-770 — Allocation of Resources Without Limits or Throttling14 documents9 sources

Severity

7.5HIGHNVD

OSV3.1

EPSS

0.1%

top 79.10%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Harfbuzz Project Harfbuzz Debian Harfbuzz Fedoraproject Fedora +6 more

Timeline

PublishedFeb 4

Latest updateFeb 3

Description

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages9 packages

▶debiandebian/harfbuzz< harfbuzz 8.0.0-1 (forky)

▶Debianharfbuzz_project/harfbuzz< 8.0.0-1+1

▶NVDharfbuzz_project/harfbuzz6.0.0

▶msrcmsrc/cm1_harfbuzz_3.4.0-1_on_cbl_mariner_1.0

▶msrcmsrc/cbl2_harfbuzz_3.4.0-3_on_cbl_mariner_2.0

Also affects: Fedora 36

Patches

Patch: chromium.googlesource.com ↗Patch: github.com ↗Patch: chromium.googlesource.com ↗

🔴Vulnerability Details

OSV

openjdk-lts, openjdk-17 regression↗2023-08-30

▶

OSV

openjdk-8, openjdk-lts, openjdk-17 vulnerabilities↗2023-08-01

▶

GHSA

GHSA-v8ff-vmc3-wr4m: hb-ot-layout-gsubgpos↗2023-02-04

▶

OSV

CVE-2023-25193: hb-ot-layout-gsubgpos↗2023-02-04

▶

📋Vendor Advisories

Ubuntu

HarfBuzz vulnerability↗2025-02-03

▶

CISA ICS

Siemens SCALANCE XCM-/XRM-300↗2024-02-15

▶

Ubuntu

OpenJDK regression↗2023-08-30

▶

Ubuntu

OpenJDK 20 vulnerabilities↗2023-08-03

▶

Ubuntu

OpenJDK vulnerabilities↗2023-08-01

▶