Bugzilla – Bug 989564
VUL-1: CVE-2015-8947: harfbuzz: hb-ot-layout-gpos-table.hh buffer over-read
Last modified: 2017-09-15 10:21:21 UTC
Originally this was about a change in Chromium "Update harfbuzz to 1.0.6" which got a CVE assigned. Affecting harfbuzz <= 1.0.4 Other items: https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679 https://github.com/behdad/harfbuzz/issues/139#issuecomment-147616887 https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957 https://github.com/behdad/harfbuzz/issues/156 However a CVE was assigned to this issue: hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052. From http://seclists.org/oss-sec/2016/q3/107 > f96664974774bfeb237a7274f512f64aaafb201e is now CVE-2015-8947. We References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8947 http://seclists.org/oss-sec/2016/q3/107 https://access.redhat.com/errata/RHSA-2016:0072 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8947
https://github.com/behdad/harfbuzz/commit/f96664974774bfeb237a7274f512f64aaafb201e https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679
Like bug 963436, NVD seems to rate these higher.
bugbot adjusting priority
This is an autogenerated message for OBS integration: This bug (989564) was mentioned in https://build.opensuse.org/request/show/417912 13.2 / harfbuzz https://build.opensuse.org/request/show/417913 42.1 / harfbuzz
This is an autogenerated message for OBS integration: This bug (989564) was mentioned in https://build.opensuse.org/request/show/417938 42.1 / harfbuzz
openSUSE-SU-2016:2082-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 963436,989564 CVE References: CVE-2015-8947,CVE-2016-2052 Sources used: openSUSE Leap 42.1 (src): harfbuzz-1.0.3-4.1 openSUSE 13.2 (src): harfbuzz-0.9.35-2.3.1
SUSE-SU-2017:1821-1: An update that solves 7 vulnerabilities and has 14 fixes is now available. Category: security (moderate) Bug References: 1015115,1015118,1015360,1017925,1021369,1021373,1028817,1034192,1034329,1034568,1035087,1036975,1042828,948058,959926,962777,963436,972777,975283,976831,989564 CVE References: CVE-2015-8947,CVE-2016-10327,CVE-2016-2052,CVE-2017-7870,CVE-2017-7882,CVE-2017-8358,CVE-2017-9433 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP2 (src): libixion-0.12.1-12.1, libmwaw-0.3.11-9.1, liborcus-0.12.1-12.1, libreoffice-5.3.3.2-40.5.9, libstaroffice-0.0.3-2.1, libzmf-0.0.1-2.1, myspell-dictionaries-20170511-15.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libixion-0.12.1-12.1, libmwaw-0.3.11-9.1, liborcus-0.12.1-12.1, libreoffice-5.3.3.2-40.5.9 SUSE Linux Enterprise Desktop 12-SP2 (src): libixion-0.12.1-12.1, libmwaw-0.3.11-9.1, liborcus-0.12.1-12.1, libreoffice-5.3.3.2-40.5.9, libstaroffice-0.0.3-2.1, libzmf-0.0.1-2.1, myspell-dictionaries-20170511-15.1
fixed
SUSE-SU-2017:2315-1: An update that solves 7 vulnerabilities and has 19 fixes is now available. Category: security (moderate) Bug References: 1015115,1015118,1015360,1017925,1021369,1021373,1021675,1028817,1034192,1034329,1034568,1035087,1035589,1036975,1042828,1045339,947117,948058,954776,959926,962777,963436,972777,975283,976831,989564 CVE References: CVE-2015-8947,CVE-2016-10327,CVE-2016-2052,CVE-2017-7870,CVE-2017-7882,CVE-2017-8358,CVE-2017-9433 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): libixion-0.12.1-13.2.1, libmwaw-0.3.11-7.5.1, liborcus-0.12.1-10.5.1, libreoffice-5.3.5.2-43.5.4, libstaroffice-0.0.3-4.1, libzmf-0.0.1-4.1, myspell-dictionaries-20170511-16.2.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): libixion-0.12.1-13.2.1, libmwaw-0.3.11-7.5.1, liborcus-0.12.1-10.5.1, libreoffice-5.3.5.2-43.5.4 SUSE Linux Enterprise Desktop 12-SP3 (src): libixion-0.12.1-13.2.1, libmwaw-0.3.11-7.5.1, liborcus-0.12.1-10.5.1, libreoffice-5.3.5.2-43.5.4, libstaroffice-0.0.3-4.1, libzmf-0.0.1-4.1, myspell-dictionaries-20170511-16.2.1
openSUSE-SU-2017:2488-1: An update that solves 7 vulnerabilities and has 19 fixes is now available. Category: security (moderate) Bug References: 1015115,1015118,1015360,1017925,1021369,1021373,1021675,1028817,1034192,1034329,1034568,1035087,1035589,1036975,1042828,1045339,947117,948058,954776,959926,962777,963436,972777,975283,976831,989564 CVE References: CVE-2015-8947,CVE-2016-10327,CVE-2016-2052,CVE-2017-7870,CVE-2017-7882,CVE-2017-8358,CVE-2017-9433 Sources used: openSUSE Leap 42.3 (src): libreoffice-5.3.5.2-3.4 openSUSE Leap 42.2 (src): libreoffice-5.3.5.2-18.9.4