PT-2018-4583

CVE-2015-9274

Published

2018-11-15

Updated

2022-11-28

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HarfBuzz versions prior to 1.0.4

Description The issue allows remote attackers to cause a denial of service, resulting in an invalid read of two bytes and application crash. This is due to mishandling of GPOS and GSUB tables, related to files such as hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.

Recommendations For HarfBuzz versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Behzad Najjarpour Jabbari

Vendors

Affected products

Weakness enumeration

CWE-125: Out-of-bounds Read

Related identifiers

CVE-2015-9274