OSV-2023-137
Heap-buffer-overflow in OT::Layout::Common::Coverage::get_population
No scoreFix available
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56510
Crash type: Heap-buffer-overflow READ 1
Crash state:
OT::Layout::Common::Coverage::get_population
OT::Layout::GPOS_impl::SinglePosFormat1::sanitize
hb_sanitize_context_t::return_t OT::Layout::GPOS_impl::PosLookupSubTable::dispat
What each source reports
OSV No score
Heap-buffer-overflow in OT::Layout::Common::Coverage::get_population
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56510
Crash type: Heap-buffer-overflow READ 1
Crash state:
OT::Layout::Common::Coverage::get_population
OT::Layout::GPOS_impl::SinglePosFormat1::sanitize
hb_sanitize_context_t::return_t OT::Layout::GPOS_impl::PosLookupSubTable::dispat
- Record
OSV-2023-137- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
harfbuzzOSS-Fuzz |
Listed versions, plus commit ranges 7.1.07.2.07.3.08.0.08.0.1 Show 37 moreShow less8.1.08.1.18.2.08.2.18.2.28.3.08.3.18.4.08.5.09.0.010.0.010.0.110.1.010.2.010.3.010.4.011.0.011.0.111.1.011.2.011.2.111.3.011.3.111.3.211.3.311.4.011.4.111.4.211.4.311.4.411.4.511.5.011.5.112.0.012.1.012.2.012.3.0 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
OSV-2023-137 is a vulnerability with no CVSS score yet in harfbuzz, published March 3, 2023. No source lists public exploit code. A source reports a fix.