CVE-2022-33068: Integer Overflow
An integer overflow in the component hb-ot-shape-fallback.cc allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Reference:
https://github.com/harfbuzz/harfbuzz/issues/3557 https://github.com/harfbuzz/harfbuzz/commit/62e803b36173fd096d7ad460dd1d1db9be542593
Other sources
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/harfbuzzto a version that resolves this vulnerability.Fixed in 6.0.0+dfsg-3Fixed in 10.2.0-1+deb13u1Fixed in 12.3.2-2Fixed in 14.4.0+ds-1 - Upgrade
Upgrade
alpine/harfbuzzto a version that resolves this vulnerability.Fixed in 4.4.1-r0 - Upgrade
Upgrade
debian/harfbuzzto a version that resolves this vulnerability.Fixed in 5.2.0-2
Event History
Frequently Asked Questions
What is CVE-2022-33068?
CVE-2022-33068 is an integer overflow vulnerability in the Harfbuzz component hb-ot-shape-fallback.cc, allowing attackers to cause a Denial of Service (DoS) attack.
What is the severity of CVE-2022-33068?
The severity of CVE-2022-33068 is medium with a CVSS score of 5.5.
How can attackers exploit CVE-2022-33068?
Attackers can exploit CVE-2022-33068 by performing unspecified vectors to trigger an integer overflow and cause a Denial of Service (DoS) attack.
What software versions are affected by CVE-2022-33068?
The Harfbuzz version 4.3.0 is affected by CVE-2022-33068.
How can I fix the CVE-2022-33068 vulnerability?
To fix the CVE-2022-33068 vulnerability, update Harfbuzz to a version that is not affected, such as version 4.3.1 or later.