OSV-2022-457

    Dashboard / Vulnerabilities / OSV-2022-457

    OSV-2022-457

    Published: 4 Jun 2022Last Modified: 4 Jun 2022

    Summary: Heap-buffer-overflow in CFF::Charset::collect_glyph_to_sid_map

    Details: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47790 ``` Crash type: Heap-buffer-overflow READ 2 Crash state: CFF::Charset::collect_glyph_to_sid_map cff_subset_plan::plan_subset_charset cff_subset_plan::create ```

    References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47790

    Affected packages

    Package

    Name: harfbuzz

    Purl: pkg:generic/harfbuzz

    Affected ranges

    Type: GIT

    Events:

    Introduced- a4d98b63ea59f17ef5e4795f6048f9cd6baa4340
    Fixed -b59e25f25ef20dddc7e4dff0432c63d1afe287ae

    Affected versions

    4.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OSV-2022-457 | CVE-DB