Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-56732: HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | harfbuzz | 0:7.0.0-2.amzn2023.0.2 |
| Amazon Linux · 2023 | harfbuzz-debuginfo | 0:7.0.0-2.amzn2023.0.2 |
| Amazon Linux · 2023 | harfbuzz-debugsource | 0:7.0.0-2.amzn2023.0.2 |
| Amazon Linux · 2023 | harfbuzz-devel | 0:7.0.0-2.amzn2023.0.2 |
| Amazon Linux · 2023 | harfbuzz-devel-debuginfo | 0:7.0.0-2.amzn2023.0.2 |
| Amazon Linux · 2023 | harfbuzz-icu | 0:7.0.0-2.amzn2023.0.2 |
| Amazon Linux · 2023 | harfbuzz-icu-debuginfo | 0:7.0.0-2.amzn2023.0.2 |
Vulnerabilities 1
-
Critical 9.3
HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer
HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-56732.html