[Bug 2167631] New: CVE-2023-25193 harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks [fedora-all]
12:24 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Bug ID: 2167631
Summary: CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
Product: Fedora
Version: 37
Status: NEW
Component: harfbuzz
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: pnemade(a)redhat.com
Reporter: saroy(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: i18n-bugs(a)lists.fedoraproject.org, klember(a)redhat.com,
moceap(a)hotmail.com, pnemade(a)redhat.com,
psatpute(a)redhat.com
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2167254
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
12:24 a.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
--- Comment #1 from Sandipan Roy <saroy(a)redhat.com> ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# low, medium, high, urgent (required)
severity=medium
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=2167254,2167631
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
12:25 a.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Sandipan Roy <saroy(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |2167254 (CVE-2023-25193)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2167254
[Bug 2167254] CVE-2023-25193 harfbuzz: allows attackers to trigger O(n^2)
growth via consecutive marks
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
4:58 a.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Parag Nemade <pnemade(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
--- Comment #2 from Parag Nemade <pnemade(a)redhat.com> ---
This will be fixed in F38+ releases and no plans currently for F37.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
5:37 a.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |MODIFIED
--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-326b7fdaf1 has been submitted as an update to Fedora 38.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-326b7fdaf1
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
6:03 a.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Red Hat One Jira (issues.redhat.com) <redhat-one-jira(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Issue Tracker
| |FC-760
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
4:25 a.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |ON_QA
--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-326b7fdaf1 has been pushed to the Fedora 38 testing repository.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-326b7fdaf1
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
1:43 a.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |MODIFIED
--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-a48406ecd2 has been submitted as an update to Fedora 38.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-a48406ecd2
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
7:57 p.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |ON_QA
--- Comment #6 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-a48406ecd2 has been pushed to the Fedora 38 testing repository.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-a48406ecd2
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
10:31 p.m.
New subject: [Bug 2167631] CVE-2023-25193 harfbuzz: allows attackers to trigger
O(n^2) growth via consecutive marks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Fixed In Version| |harfbuzz-7.0.1-2.fc38
Resolution|--- |ERRATA
Last Closed| |2023-03-14 03:31:14
--- Comment #7 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-a48406ecd2 has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2167631
406
days inactive
441
days old
i18n-bugs@lists.fedoraproject.org
9 comments
1 participants
participants (1)
-
bugzilla＠redhat.com