CVE-2024-56732 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 46%

Affected Products (NVD)

Vendor	Product	Version
harfbuzz_project	harfbuzz	8.5.0 ≤ 𝑥 ≤ 10.0.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

harfbuzz

bookworm	6.0.0+dfsg-3 not-affected
bullseye	2.7.4-1 not-affected
forky	12.2.0-1 fixed
sid	12.2.0-1 fixed
trixie	10.2.0-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

harfbuzz

bionic	needs-triage
focal	not-affected
jammy	not-affected
noble	not-affected
oracular	Fixed 9.0.0-1ubuntu0.1 released
plucky	Fixed 10.2.0-1 released
questing	Fixed 10.2.0-1 released
trusty	needs-triage
xenial	needs-triage

Amazon Linux Releases

Amazon Package

Release

harfbuzz

Amazon Linux 2023

0:7.0.0-2.amzn2023.0.2

fixed

harfbuzz-debuginfo

Amazon Linux 2023

0:7.0.0-2.amzn2023.0.2

fixed

harfbuzz-debugsource

Amazon Linux 2023

0:7.0.0-2.amzn2023.0.2

fixed

harfbuzz-devel

Amazon Linux 2023

0:7.0.0-2.amzn2023.0.2

fixed

harfbuzz-devel-debuginfo

Amazon Linux 2023

0:7.0.0-2.amzn2023.0.2

fixed

harfbuzz-icu

Amazon Linux 2023

0:7.0.0-2.amzn2023.0.2

fixed

harfbuzz-icu-debuginfo

Amazon Linux 2023

0:7.0.0-2.amzn2023.0.2

fixed

Azure Linux Releases

Azure Package

Release

harfbuzz

Azure Linux 3.0

0:8.3.0-3.azl3

fixed

qtbase

Azure Linux 3.0

0:6.6.3-2.azl3

fixed

Known Exploits!

https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://github.com/harfbuzz/harfbuzz/commit/1767f99e2e2196c3fcae27db6d8b60098d3f6d26

https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m