Remote Denial of Service Vulnerability in HarfBuzz by Google
CVE-2015-8947

7.6HIGH

Key Information:

Vendor

Harfbuzz Project

Status
Harfbuzz
Vendor
CVE Published:
19 July 2016

What is CVE-2015-8947?

A vulnerability in HarfBuzz allows remote attackers to exploit a buffer over-read condition. This issue can lead to a denial of service, allowing crafted data to trigger the vulnerability. It is crucial for users of HarfBuzz to ensure they are running an updated version to mitigate this risk. The vulnerability has been acknowledged by various security sources and has implications for software relying on HarfBuzz for handling text layout.

References

http://rhn.redhat.com/errata/RHSA-2016-0072.html
vendor-advisoryx_refsource_REDHAT
https://github.com/behdad/harfbuzz/commit/f96664974774bfe...
x_refsource_CONFIRM
https://security.gentoo.org/glsa/201701-76
vendor-advisoryx_refsource_GENTOO

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.