Denial of Service Vulnerabilities in HarfBuzz Utilized by Google Chrome
CVE-2016-2052

7.6HIGH

Key Information:

Vendor

Harfbuzz Project

Status
Harfbuzz
Vendor
CVE Published:
25 January 2016

What is CVE-2016-2052?

Multiple unspecified vulnerabilities exist in HarfBuzz, a text shaping library, prior to version 1.0.6. These vulnerabilities, especially when exploited in Google Chrome before version 48.0.2564.82, allow attackers to potentially induce a denial of service. The vulnerabilities stem from crafted data inputs, leading to conditions such as buffer over-reads caused by incorrect length checks in the hb-ot-font.cc file. This can significantly disrupt the functioning of applications relying on HarfBuzz for text rendering.

References

https://code.google.com/p/chromium/issues/detail?id=544270
x_refsource_CONFIRM
https://code.google.com/p/chromium/issues/detail?id=579625
x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-0072.html
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.