Harfbuzz
Monthly
An out-of-bounds write in HarfBuzz 8.0.0 through 14.6.0 allows a crafted font containing an embedded WebAssembly module to write glyph-name bytes past the end of the module's linear memory and into host process memory, crashing or potentially corrupting the consuming application. The flaw only manifests in builds where the experimental WebAssembly shaping backend is compiled in (HAVE_WASM/WAMR support), which is disabled by default; the attacker must also precisely arrange the module's memory layout so the output buffer sits at the end of linear memory, and a victim must load and shape the malicious font. Per the available data there is confirmed active exploitation is not indicated and no public exploit code was identified at time of analysis; upstream fix code exists as a pull request but a tagged patched release was not independently confirmed, and the non-default build requirement plus the precise layout precondition keep practical risk below what the raw memory-corruption classification suggests.
HarfBuzz::Shaper for Perl versions before 0.032 contain a null pointer dereference in the bundled HarfBuzz library that allows remote attackers to cause a denial of service without authentication or user interaction. The vulnerability affects applications using vulnerable versions of the library and results in service unavailability. No patch is currently available.
NULL pointer dereference in HarfBuzz 8.0.0 through 14.6.0 lets a crafted font crash any application that shapes text with it, but only when the library is built with the experimental WebAssembly shaper enabled - a non-default compile-time option. An unauthenticated attacker supplies a malicious font whose embedded wasm module passes out-of-range addresses with non-zero lengths into the buffer_set_contents, face_create, or font_set_coords host imports, and the resulting crash yields availability-only impact (CVSS 3.1 base 6.8, AV:L/AC:L/PR:N/UI:R/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the dominant risk limiter remains that default HarfBuzz builds never exercise the vulnerable code path.
HarfBuzz text shaping engine versions prior to 12.3.0 crash when the SubtableUnicodesCache::create function attempts to dereference a null pointer returned by failed memory allocation, enabling denial of service in applications processing untrusted font data. Public exploit code exists for this vulnerability. A patch is available in version 12.3.0 and later.
HarfBuzz is a text shaping engine. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in HarfBuzz 8.0.0 through 14.6.0 allows a crafted font containing an embedded WebAssembly module to write glyph-name bytes past the end of the module's linear memory and into host process memory, crashing or potentially corrupting the consuming application. The flaw only manifests in builds where the experimental WebAssembly shaping backend is compiled in (HAVE_WASM/WAMR support), which is disabled by default; the attacker must also precisely arrange the module's memory layout so the output buffer sits at the end of linear memory, and a victim must load and shape the malicious font. Per the available data there is confirmed active exploitation is not indicated and no public exploit code was identified at time of analysis; upstream fix code exists as a pull request but a tagged patched release was not independently confirmed, and the non-default build requirement plus the precise layout precondition keep practical risk below what the raw memory-corruption classification suggests.
HarfBuzz::Shaper for Perl versions before 0.032 contain a null pointer dereference in the bundled HarfBuzz library that allows remote attackers to cause a denial of service without authentication or user interaction. The vulnerability affects applications using vulnerable versions of the library and results in service unavailability. No patch is currently available.
NULL pointer dereference in HarfBuzz 8.0.0 through 14.6.0 lets a crafted font crash any application that shapes text with it, but only when the library is built with the experimental WebAssembly shaper enabled - a non-default compile-time option. An unauthenticated attacker supplies a malicious font whose embedded wasm module passes out-of-range addresses with non-zero lengths into the buffer_set_contents, face_create, or font_set_coords host imports, and the resulting crash yields availability-only impact (CVSS 3.1 base 6.8, AV:L/AC:L/PR:N/UI:R/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the dominant risk limiter remains that default HarfBuzz builds never exercise the vulnerable code path.
HarfBuzz text shaping engine versions prior to 12.3.0 crash when the SubtableUnicodesCache::create function attempts to dereference a null pointer returned by failed memory allocation, enabling denial of service in applications processing untrusted font data. Public exploit code exists for this vulnerability. A patch is available in version 12.3.0 and later.
HarfBuzz is a text shaping engine. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.