CVE-2023-25193: fedoraproject fedora
CVSS: 7.5v3.1HighModified
AliasesSUSE-SU-2023:1820-1SUSE-SU-2023:1821-1SUSE-SU-2023:1822-1SUSE-SU-2023:1852-1RHSA-2024:2410RHSA-2024:2980UBUNTU-CVE-2023-25193USN-7251-1DEBIAN-CVE-2023-25193CGA-2399-m4jg-rxf2CGA-2q3q-cmw5-5rm8CGA-9f4r-vjxj-67j7CGA-9mc3-7x64-4h7wCGA-ggqp-4jcj-395vCGA-mc94-wr82-5vrjCGA-v46q-fj3f-vgjgCGA-vhp2-2556-2487openSUSE-SU-2024:12660-1
Published 04-02-2023Last modified 25-03-2025
Vulnerability summary
CVE-2023-25193 is a high (CVSS 7.5) vulnerability in fedoraproject fedora. EPSS estimates a 1.81% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.81%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 25 · Related 19MGASA-2023-0272OPENSUSE-SU-2024:13075-1OPENSUSE-SU-2024:13076-1OPENSUSE-SU-2024:13131-1OPENSUSE-SU-2025:0066-1OPENSUSE-SU-2025:0067-1RHSA-2023:4157RHSA-2023:4158RHSA-2023:4159RHSA-2023:4162RHSA-2023:4163RHSA-2023:4164RHSA-2023:4165RHSA-2023:4169RHSA-2023:4170RHSA-2023:4171RHSA-2023:4175RHSA-2023:4177RHSA-2023:4233SUSE-SU-2023:2990-1SUSE-SU-2023:3023-1SUSE-SU-2023:3287-1SUSE-SU-2023:3406-1SUSE-SU-2023:3441-1USN-6263-1CGA-4M5M-7MMW-26XXCGA-6Q42-WFWR-QF22CGA-8GVM-6Q43-M452CGA-8H2F-CGW9-HWQFCGA-8QVX-RPQP-4GPPCGA-8QW3-G7JV-PFF5CGA-R8Q6-RJ77-56QJCGA-XG88-PCC2-J423
Timeline
- 04-02-2023PublishedVulnerability first disclosed.
- 25-03-2025Last modifiedVulnerability information updated.
Description
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.81%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.81% on 18-09-2026
18-09-202618-10-2026
EPSS score1.81%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse29 products
- harfbuzz&distro=SUSE Enterprise Storage 7< 2.6.4-150200.3.6.1
- harfbuzz&distro=SUSE Enterprise Storage 7.1< 2.6.4-150200.3.6.1
- harfbuzz&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.7.5-150000.3.3.1
- harfbuzz&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2.6.4-150200.3.6.1
- harfbuzz&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 2.6.4-150200.3.6.1
Ubuntu8 products
- harfbuzzAll versions (No fix recorded) | < 2.6.4-1ubuntu4.3 | < 2.7.4-1ubuntu3.2
- openjdk-13All versions (No fix recorded)
- openjdk-16All versions (No fix recorded)
- openjdk-17< 17.0.8+7-1~18.04 | < 17.0.8+7-1~20.04.2 | < 17.0.8+7-1~22.04
- openjdk-18All versions (No fix recorded)
Redhat7 products
- harfbuzz< 0:2.7.4-10.el9 | < 0:1.7.5-4.el8
- harfbuzz-debuginfo< 0:2.7.4-10.el9 | < 0:1.7.5-4.el8
- harfbuzz-debugsource< 0:2.7.4-10.el9 | < 0:1.7.5-4.el8
- harfbuzz-devel< 0:2.7.4-10.el9 | < 0:1.7.5-4.el8
- harfbuzz-devel-debuginfo< 0:2.7.4-10.el9 | < 0:1.7.5-4.el8
Chainguard4 products
- openjdk-14< 14.0.2.12-r7
- openjdk-15< 15.0.10.5-r7
- openjdk-16< 16.0.2.7-r7
- openjdk-19-jre< 19.0.2.7-r6
Wolfi4 products
- openjdk-14< 14.0.2.12-r7
- openjdk-15< 15.0.10.5-r7
- openjdk-16< 16.0.2.7-r7
- openjdk-19-jre< 19.0.2.7-r6
Opensuse3 products
- harfbuzz&distro=openSUSE Leap 15.4< 3.4.0-150400.3.6.1
- harfbuzz&distro=openSUSE Leap Micro 5.3< 3.4.0-150400.3.6.1
- harfbuzz&distro=openSUSE Tumbleweed< 6.0.0-2.1
Debian1 product
- harfbuzzAll versions (No fix recorded) | < 8.0.0-1
Fedoraproject1 product
- fedoraEOL36
Harfbuzz_project1 product
- harfbuzz≤ 6.0.0
9 vendors · 58 products
References
29 links- github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dcREPORTFIXPatchThird Party Advisory
- chromium.googlesource.com/chromium/src/+/e1f324aa681af54101c1f2d173d92adb80e37088/DEPSREPORTWEBPatchThird Party Advisory
