Denial of Service Vulnerability in HarfBuzz Affects Multiple Applications
CVE-2015-9274

6.5MEDIUM

Key Information:

Vendor: Harfbuzz Project
Status: Harfbuzz
Vendor: CVE Published:; 15 November 2018

🔔 Create Harfbuzz Project Vulnerability Alert

What is CVE-2015-9274?

HarfBuzz, prior to version 1.0.4, is susceptible to a denial of service attack due to the improper handling of GPOS and GSUB tables. This vulnerability may be exploited by remote attackers to trigger an invalid read of two bytes, leading to an application crash. The affected components are linked to specific header files including hb-ot-layout-gpos-table.hh and hb-ot-layout-gsub-table.hh, complicating the rendering process and resulting in potential disruptions for users.

References

https://github.com/harfbuzz/harfbuzz/commit/c917965b9e6fe...

x_refsource_MISC

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 15, 2018
Vulnerability Reserved
Nov 14, 2018

CVE-2015-9274 Data

JSON