CVE-2023-25193

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.(CVE-2023-25193)

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.(CVE-2023-25193)

HarfBuzz is an implementation of the OpenType Layout engine.

Security Fix(es):

• harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks (CVE-2023-25193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.

HarfBuzz is an implementation of the OpenType Layout engine.

Security Fix(es):

• harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks (CVE-2023-25193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Root has patched CVE-2023-25193 in the harfbuzz package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2023-25193 in the harfbuzz package for Root:Debian:12. Multiple fixed versions available.

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

• OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
• OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
• OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
• harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
• OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
• OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [almalinux-9] (BZ#2223100)

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
• OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
• OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
• harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
• OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
• OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)
• OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221655)
• Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-8] (BZ#2222368)

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

• OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
• OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
• OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
• harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
• OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
• OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime() method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the fix has been reverted in JDK 11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222493)
• Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [almalinux-8] (BZ#2223101)

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
• OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
• OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
• harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
• OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
• OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)
• OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221653)
• Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-9] (BZ#2222852)

HarfBuzz is an implementation of the OpenType Layout engine.

Security Fix(es):

• harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks (CVE-2023-25193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

HarfBuzz is an implementation of the OpenType Layout engine.

Security Fix(es):

• harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks (CVE-2023-25193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

- CVE-2023-22006, CVE-2023-22036, CVE-2023-22041, CVE-2023-22044,
  CVE-2023-22045, CVE-2023-22049, CVE-2023-25193.
- Release notes:
  https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-July/024064.html

• CVE-2023-25193: optimize looking back for base glyphs in hb-ot-layout-gsubgpos-private.hh

• CVE-2023-25193: fix O(n^2) growth triggered by consecutive marks during mark attachment

• Update to jdk-17.0.15+6
• Set bundled freetype provide version to 2.13.2
• Set bundled harfbuzz provide version to 8.2.2
• Require tzdata-java 2025a at runtime and for build
• CVE-2025-21502: fix Hotspot component vulnerability allowing unauthorized access to resources and exposure of sensitive information
• CVE-2025-30698: fix 2D component vulnerability allowing unauthorized data access and partial denial of service
• CVE-2025-30691: fix Compiler component vulnerability allowing unauthorized data access and modification (CVSS 4.8 Medium)
• CVE-2025-21587: fix JSSE component vulnerability allowing unauthorized creation/deletion/modification of critical data
• CVE-2024-20921: fix information disclosure in Hotspot that allows remote attackers to access sensitive data via untrusted input through exposed APIs or sandboxed environments
• CVE-2024-21235: fix vulnerability in Hotspot that allows remote attackers to read or modify limited data via untrusted input through exposed APIs or sandboxed code
• CVE-2024-21217: fix vulnerability in Serialization that allows remote attackers to trigger partial denial of service via untrusted input through exposed APIs or sandboxed code
• CVE-2024-21210: fix vulnerability in Hotspot that allows remote attackers to modify limited data via untrusted input through exposed APIs or sandboxed code.
• CVE-2024-21208: fix security vulnerability in OpenJDK component
• CVE-2024-21147: fix Hotspot component vulnerability allowing unauthorized data access
• CVE-2024-21145: fix 2D component vulnerability allowing unauthorized data access
• CVE-2024-21144: fix security vulnerability in OpenJDK component
• CVE-2024-21140: fix Hotspot component vulnerability
• CVE-2024-21138: fix Hotspot component vulnerability causing partial denial of service
• CVE-2024-21131: fix vulnerability in Hotspot that allows remote attackers to modify limited data via untrusted input through exposed APIs or sandboxed code
• CVE-2024-21094: fix Hotspot component vulnerability allowing unauthorized data modification
• CVE-2024-21085: fix Concurrency component vulnerability causing partial denial of service
• CVE-2024-21068: fix Hotspot component vulnerability allowing unauthorized data access
• CVE-2024-21011: fix Hotspot component vulnerability causing partial denial of service
• CVE-2024-20918: fix information disclosure and data modification in Hotspot via untrusted input
• CVE-2024-20952: fix information disclosure and data modification in Security via untrusted input
• CVE-2024-20926: fix information disclosure in Scripting via untrusted input
• CVE-2023-48161: fix buffer overflow in GifLib’s DumpSCreen2RGB function allowing local attackers to access sensitive information
• CVE-2023-22025: fix data modification in Hotspot via untrusted input through exposed APIs or sandboxed code
• CVE-2023-25193: fix O(n^2) growth vulnerability in HarfBuzz's hb-ot-layout-gsubgpos.hh when processing consecutive marks

• CVE-2023-25193: optimize looking back for base glyphs in hb-ot-layout-gsubgpos-private.hh

• SECURITY UPDATE: DoS via O(n^2) mark attachment in GPOS
  • debian/patches/CVE-2023-25193.patch: cache the last base in MarkBasePos/MarkLigPos, speed up unsafe_to_break()
  • CVE-2023-25193

• CVE-2023-25193: optimize looking back for base glyphs in hb-ot-layout-gsubgpos-private.hh

The updated packages fix security vulnerabilities and a file conflict :

Improper connection handling during TLS handshake. (CVE-2023-21930)

Incorrect enqueue of references in garbage collector. (CVE-2023-21954)

Certificate validation issue in TLS session negotiation. (CVE-2023-21967)

Swing HTML parsing issue. (CVE-2023-21939)

Incorrect handling of NULL characters in ProcessBuilder. (CVE-2023-21938)

Missing string checks for NULL characters. (CVE-2023-21937)

Missing check for slash characters in URI-to-path conversion. (CVE-2023-21968)

Array indexing integer overflow issue. (CVE-2023-22045)

Improper handling of slash characters in URI-to-path conversion. (CVE-2023-22049)

O(n^2) growth via consecutive marks. (CVE-2023-25193)

HTTP client insufficient file name validation. (CVE-2023-22006)

ZIP file parsing infinite loop. (CVE-2023-22036)

Modulo operator array indexing issue. (CVE-2023-22044)

Weakness in AES implementation. (CVE-2023-22041)

These are all security issues fixed in the harfbuzz-devel-6.0.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openjdk-11.0.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openjdk-17.0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openj9-17.0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openj9 fixes the following issues:

• Update to OpenJDK 11.0.26 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

• Update to OpenJDK 11.0.24 with OpenJ9 0.46.0 virtual machine

• Including Oracle July 2024 CPU changes

  • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21144 (boo#1228050), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

• Update to OpenJDK 11.0.23 with OpenJ9 0.44.0 virtual machine

• Including Oracle April 2024 CPU changes

  • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21085 (boo#1222984), CVE-2024-21068 (boo#1222983)

• Including OpenJ9/OMR specific fix:

  • CVE-2024-3933 (boo#1225470)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/

• Update to OpenJDK 11.0.22 with OpenJ9 0.43.0 virtual machine

• Including Oracle January 2024 CPU changes

  • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20926 (boo#1218906), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

• Remove the possibility to put back removes JavaEE modules, since our Java stack does not need this hack any more

• Update to OpenJDK 11.0.21 with OpenJ9 0.41.0 virtual machine

• Including Oracle October 2023 CPU changes

  • CVE-2023-22081, boo#1216374

• Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41

• Update to OpenJDK 11.0.20.1 with OpenJ9 0.40.0 virtual machine

  • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

• Update to OpenJDK 11.0.20 with OpenJ9 0.40.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

• Update to OpenJDK 11.0.19 with OpenJ9 0.38.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
  • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

• Update to OpenJDK 11.0.18 with OpenJ9 0.36.1 virtual machine

  • Including Oracle January 2023 CPU changes
    • CVE-2023-21835, boo#1207246
    • CVE-2023-21843, boo#1207248
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36

• Update to OpenJDK 11.0.17 with OpenJ9 0.35.0 virtual machine

  • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
  • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

• Update to OpenJDK 11.0.16 with OpenJ9 0.33.0 virtual machine

  • Including Oracle July 2022 CPU changes CVE-2022-21540 (boo#1201694), CVE-2022-21541 (boo#1201692), CVE-2022-34169 (boo#1201684)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.33

• Update to OpenJDK 11.0.15 with OpenJ9…