CVE-2023-25193

2023-02-0420:15:08

Alpine Linux Development Team

security.alpinelinux.org

harfbuzz

o(n^2) growth

cve-2023-25193

unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

68.2%

JSON

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

OSVersionArchitecturePackageVersionFilename
Alpine3.17-mainnoarchharfbuzz= 5.3.1-r1UNKNOWN
Alpine3.16-mainnoarchharfbuzz= 4.3.0-r0UNKNOWN
Alpine3.15-mainnoarchharfbuzz= 3.0.0-r2UNKNOWN
Alpine3.14-mainnoarchharfbuzz= 2.8.1-r0UNKNOWN
Alpineedge-communitynoarchopenjdk11< 11.0.20_p8-r0UNKNOWN
Alpineedge-communitynoarchopenjdk17< 17.0.8_p7-r0UNKNOWN
Alpine3.16-communitynoarchopenjdk11< 11.0.20_p8-r0UNKNOWN
Alpine3.16-communitynoarchopenjdk17< 17.0.8_p7-r0UNKNOWN
Alpine3.17-communitynoarchopenjdk11< 11.0.20_p8-r0UNKNOWN
Alpine3.17-communitynoarchopenjdk17< 17.0.8_p7-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.17-main	noarch	harfbuzz	= 5.3.1-r1	UNKNOWN
Alpine	3.16-main	noarch	harfbuzz	= 4.3.0-r0	UNKNOWN
Alpine	3.15-main	noarch	harfbuzz	= 3.0.0-r2	UNKNOWN
Alpine	3.14-main	noarch	harfbuzz	= 2.8.1-r0	UNKNOWN
Alpine	edge-community	noarch	openjdk11	< 11.0.20_p8-r0	UNKNOWN
Alpine	edge-community	noarch	openjdk17	< 17.0.8_p7-r0	UNKNOWN
Alpine	3.16-community	noarch	openjdk11	< 11.0.20_p8-r0	UNKNOWN
Alpine	3.16-community	noarch	openjdk17	< 17.0.8_p7-r0	UNKNOWN
Alpine	3.17-community	noarch	openjdk11	< 11.0.20_p8-r0	UNKNOWN
Alpine	3.17-community	noarch	openjdk17	< 17.0.8_p7-r0	UNKNOWN