Vulnerability in harfbuzz: UNKNOWN READ in OT::avar::map_coords
Summary
OSV-2022-613: UNKNOWN READ in OT::avar::map_coords. Affects harfbuzz versions >= edca52c3b644f6ebc90eeeb307ed3e87a7245348, < 32c85b8c8c1994e318dce49b928a7298a0b23560. Fixed in 32c85b8c8c1994e318dce49b928a7298a0b23560. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Harfbuzz is an open-source text shaping library that is widely used in various applications to provide high-quality text rendering. It supports multiple font formats and provides advanced typographic features. However, a vulnerability has been discovered in the library that could potentially lead to a security breach.
Vulnerability Detail
The vulnerability, identified as OSV-2022-613, involves an UNKNOWN READ issue in the OT::avar::map_coords function of harfbuzz. This vulnerability was reported through the OSS-Fuzz project. The exact cause and impact of the vulnerability are not specified in the available information. However, it is categorized as having a medium severity level. The vulnerability affects versions of harfbuzz prior to commit edca52c3b644f6ebc90eeeb307ed3e87a7245348 and has been fixed in commit 32c85b8c8c1994e318dce49b928a7298a0b23560.
How To Fix
Minimum fixed version
32c85b8c8c1994e318dce49b928a7298a0b23560
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is advised to follow the recommended fix procedure and update the library to the patched version.
Conclusion
In conclusion, the harfbuzz library is affected by a medium severity vulnerability (OSV-2022-613) that involves an UNKNOWN READ issue. To mitigate this vulnerability, it is crucial to update the library to a version that includes the fix commit 32c85b8c8c1994e318dce49b928a7298a0b23560 or later. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for harfbuzz →
FAQ
Harfbuzz is an open-source text shaping library used for high-quality text rendering in various applications.
The exact impact of this vulnerability is not specified, but it is categorized as having a medium severity level.
To fix this vulnerability, update the harfbuzz library to a version that includes the fix commit 32c85b8c8c1994e318dce49b928a7298a0b23560 or later.
No specific workaround has been mentioned for this vulnerability. It is recommended to update the library to the patched version.
For more information about this vulnerability, you can refer to the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for harfbuzz.
