CVE-2023-25193: High severity Harfbuzz Project Harfbuzz vulnerability

Published Feb 4, 2023
·
Updated

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

Other sources

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

Affected Software

35 affected componentsFixes available
redhat/java<11-openjdk-1:11.0.20.0.8-1.el7_9
11-openjdk-1:11.0.20.0.8-1.el7_9
redhat/java<17-openjdk-1:17.0.8.0.7-2.el8
17-openjdk-1:17.0.8.0.7-2.el8
redhat/java<11-openjdk-1:11.0.20.0.8-2.el8
11-openjdk-1:11.0.20.0.8-2.el8
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_1
11-openjdk-1:11.0.20.0.8-1.el8_1
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_2
11-openjdk-1:11.0.20.0.8-1.el8_2
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_4
11-openjdk-1:11.0.20.0.8-1.el8_4
redhat/java<17-openjdk-1:17.0.8.0.7-1.el8_4
17-openjdk-1:17.0.8.0.7-1.el8_4
redhat/java<11-openjdk-1:11.0.20.0.8-1.el8_6
11-openjdk-1:11.0.20.0.8-1.el8_6
redhat/java<17-openjdk-1:17.0.8.0.7-1.el8_6
17-openjdk-1:17.0.8.0.7-1.el8_6
redhat/java<11-openjdk-1:11.0.20.0.8-2.el9
11-openjdk-1:11.0.20.0.8-2.el9
redhat/java<17-openjdk-1:17.0.8.0.7-2.el9
17-openjdk-1:17.0.8.0.7-2.el9
redhat/java<11-openjdk-1:11.0.20.0.8-1.el9_0
11-openjdk-1:11.0.20.0.8-1.el9_0
redhat/java<17-openjdk-1:17.0.8.0.7-1.el9_0
17-openjdk-1:17.0.8.0.7-1.el9_0
redhat/harfbuzz<7.0.0
7.0.0
debian/harfbuzz<=2.7.4-1, <=6.0.0+dfsg-3
10.2.0-1
Harfbuzz Project Harfbuzz<=6.0.0
Fedoraproject Fedora=36
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk11<11.0.20_p8-r0
11.0.20_p8-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0
alpine/openjdk17<17.0.8_p7-r0
17.0.8_p7-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-1.el7_9
  2. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 17-openjdk-1:17.0.8.0.7-2.el8
  3. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-2.el8
  4. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-1.el8_1
  5. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-1.el8_2
  6. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-1.el8_4
  7. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 17-openjdk-1:17.0.8.0.7-1.el8_4
  8. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-1.el8_6
  9. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 17-openjdk-1:17.0.8.0.7-1.el8_6
  10. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-2.el9
  11. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 17-openjdk-1:17.0.8.0.7-2.el9
  12. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 11-openjdk-1:11.0.20.0.8-1.el9_0
  13. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 17-openjdk-1:17.0.8.0.7-1.el9_0
  14. Upgrade

    Upgrade redhat/harfbuzz to a version that resolves this vulnerability.

    Fixed in 7.0.0
  15. Upgrade

    Upgrade debian/harfbuzz to a version that resolves this vulnerability.

    Fixed in 10.2.0-1
  16. Upgrade

    Upgrade alpine/openjdk11 to a version that resolves this vulnerability.

    Fixed in 11.0.20_p8-r0
  17. Upgrade

    Upgrade alpine/openjdk17 to a version that resolves this vulnerability.

    Fixed in 17.0.8_p7-r0

Event History

Feb 4, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·08:15 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the vulnerability ID for this flaw in HarfBuzz?

The vulnerability ID is CVE-2023-25193.

2

What is the severity of CVE-2023-25193?

The severity of CVE-2023-25193 is high.

3

How does CVE-2023-25193 affect HarfBuzz?

CVE-2023-25193 allows attackers to trigger O(n^2) growth in HarfBuzz through consecutive marks during the process of looking back for base glyphs when attaching marks.

4

Which software versions are affected by CVE-2023-25193?

The affected software versions include HarfBuzz 2.3.1-1 up to and inclusive of 6.0.0+dfsg-3.

5

Are there any remediation steps or fixes available for CVE-2023-25193?

Yes, there are remediation steps available. Please refer to the official references for more information.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203