PT-2022-4310 · Harfbuzz+10 · Harfbuzz+10

Pietroborrello · Published 2022-06-22 · Updated 2025-09-19 · CVE-2022-33068

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Harfbuzz version 4.3.0

Description The issue is related to an integer overflow in the hb-ot-shape-fallback.cc component of the Harfbuzz library, which can be exploited by attackers to cause a Denial of Service (DoS) via unspecified vectors. This can be achieved by sending specially crafted data to the application, resulting in an integer overflow and potentially leading to a crash.

Recommendations For Harfbuzz version 4.3.0, consider updating to a newer version that includes a fix for the integer overflow issue in the hb-ot-shape-fallback.cc component. As a temporary workaround, restrict the input data to prevent specially crafted requests from causing the integer overflow.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2022:8384

BDU:2022-05166

CESA-2022_7000

CESA-2022_7012

CVE-2022-33068

OESA-2022-1777

OPENSUSE-SU-2022:2663-1

OPENSUSE-SU-2022_2663-1

OPENSUSE-SU-2022_2664-1

OPENSUSE-SU-2024:12168-1

RHSA-2022:6999

RHSA-2022:7000

RHSA-2022:7012

RHSA-2022:7013

RHSA-2022:8384

RHSA-2022_6999

RHSA-2022_7000

RHSA-2022_7012

RHSA-2022_7013

RHSA-2022_8384

RLSA-2022:8384

SUSE-SU-2022:2663-1

SUSE-SU-2022:2664-1

SUSE-SU-2022_2663-1

SUSE-SU-2022_2664-1

USN-5524-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Harfbuzz

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 51

• 🔥 https://github.com/harfbuzz/harfbuzz/issues/3557 · Exploit
• https://github.com/harfbuzz/harfbuzz/commit/62e803b36173fd096d7ad460dd1d1db9be542593 · Patch
• https://errata.almalinux.org/9/ALSA-2022-8384.html · Vendor Advisory
• https://security.gentoo.org/glsa/202209-11 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2663-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-33068 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FQBJ24W6TXLSAQWCFW7IBGUMX4AJI3S4 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8384.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2664-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W56WTC5IY4EIUHVUIHMCXA3BSBZLSZCI · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/W56WTC5IY4EIUHVUIHMCXA3BSBZLSZCI · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-33068 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33068 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33068 · Security Note