CVE-2023-25193: High severity harfbuzz vulnerability

Published Feb 4, 2023
·
Updated

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

Other sources

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

Affected Software

17 affected componentsFixes available
redhat/java<11-openjdk-1:11.0.20.0.8-1.el7_9
11-openjdk-1:11.0.20.0.8-1.el7_9
redhat/java<17-openjdk-1:17.0.8.0.7-2.el8
17-openjdk-1:17.0.8.0.7-2.el8
redhat/java<11-openjdk-1:11.0.20.0.8-2.el8
11-openjdk-1:11.0.20.0.8-2.el8
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_1
11-openjdk-1:11.0.20.0.8-1.el8_1
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_2
11-openjdk-1:11.0.20.0.8-1.el8_2
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_4
11-openjdk-1:11.0.20.0.8-1.el8_4
redhat/java<17-openjdk-1:17.0.8.0.7-1.el8_4
17-openjdk-1:17.0.8.0.7-1.el8_4
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_6
11-openjdk-1:11.0.20.0.8-1.el8_6
redhat/java<17-openjdk-1:17.0.8.0.7-1.el8_6
17-openjdk-1:17.0.8.0.7-1.el8_6
redhat/java<11-openjdk-1:11.0.20.0.8-2.el9
11-openjdk-1:11.0.20.0.8-2.el9
redhat/java<17-openjdk-1:17.0.8.0.7-2.el9
17-openjdk-1:17.0.8.0.7-2.el9
redhat/java<11-openjdk-1:11.0.20.0.8-1.el9_0
11-openjdk-1:11.0.20.0.8-1.el9_0
redhat/java<17-openjdk-1:17.0.8.0.7-1.el9_0
17-openjdk-1:17.0.8.0.7-1.el9_0
redhat/harfbuzz<7.0.0
7.0.0
debian/harfbuzz<=2.7.4-1, <=6.0.0+dfsg-3
10.2.0-1
Harfbuzz Project Harfbuzz<=6.0.0
Fedoraproject Fedora=36

Event History

Feb 4, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 12, 2024
Data Sourced
via Launchpad·12:16 AM
Description
Feb 4, 2025
Data Sourced
via Ubuntu·05:09 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the vulnerability ID for this flaw in HarfBuzz?

The vulnerability ID is CVE-2023-25193.

2

What is the severity of CVE-2023-25193?

The severity of CVE-2023-25193 is high.

3

How does CVE-2023-25193 affect HarfBuzz?

CVE-2023-25193 allows attackers to trigger O(n^2) growth in HarfBuzz through consecutive marks during the process of looking back for base glyphs when attaching marks.

4

Which software versions are affected by CVE-2023-25193?

The affected software versions include HarfBuzz 2.3.1-1 up to and inclusive of 6.0.0+dfsg-3.

5

Are there any remediation steps or fixes available for CVE-2023-25193?

Yes, there are remediation steps available. Please refer to the official references for more information.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203