Headline
Ubuntu Security Notice USN-5524-1
Ubuntu Security Notice 5524-1 - It was discovered that HarfBuzz incorrectly handled certain glyph sizes. A remote attacker could use this issue to cause HarfBuzz to crash, resulting in a denial of service.
==========================================================================
Ubuntu Security Notice USN-5524-1
July 19, 2022
harfbuzz vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
HarfBuzz could be made to crash if it opened specially crafted data.
Software Description:
- harfbuzz: OpenType text shaping engine
Details:
It was discovered that HarfBuzz incorrectly handled certain glyph sizes. A
remote attacker could use this issue to cause HarfBuzz to crash, resulting
in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libharfbuzz0b 2.7.4-1ubuntu3.1
Ubuntu 20.04 LTS:
libharfbuzz0b 2.6.4-1ubuntu4.2
After a standard system update you need to restart your session to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5524-1
CVE-2022-33068
Package Information:
https://launchpad.net/ubuntu/+source/harfbuzz/2.7.4-1ubuntu3.1
https://launchpad.net/ubuntu/+source/harfbuzz/2.6.4-1ubuntu4.2
Related news
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.
An update for harfbuzz is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-33068: harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc
Gentoo Linux Security Advisory 202209-11 - Multiple vulnerabilities have been discovered in HarfBuzz, the worst of which could result in arbitrary code execution. Versions less than 4.4.0 are affected.
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.