CVE catalog
CVE-2015-9274
harfbuzz: CVE-2015-9274
- Severity
- Medium · CVSS 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.54% · Oct 25, 2026
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | harfbuzz | sid | 12.3.2-2 | fixed |
| Debian | harfbuzz | forky | 12.3.2-2 | fixed |
| Debian | harfbuzz | trixie | 10.2.0-1+deb13u1 | fixed |
| Debian | harfbuzz | bookworm | 6.0.0+dfsg-3 | fixed |
| Ubuntu | harfbuzz | pro | 1.0.1-1build2 | vulnerable |
| Ubuntu | harfbuzz | pro | 1.0.1-1ubuntu0.1 | vulnerable |
| Ubuntu | harfbuzz | pro | 1.0.1-1ubuntu0.1+esm1 | fixed |
| Ubuntu | harfbuzz | pro | 1.0.1-1build2 | vulnerable |
| Ubuntu | harfbuzz | pro | 1.0.1-1ubuntu0.1 | vulnerable |
| Ubuntu | harfbuzz | pro | 1.0.1-1ubuntu0.1+esm1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | harfbuzz | source | sid | 1.2.6-1 | not yet assigned | Not reported | Not reported |
| Debian | harfbuzz | source | forky | 1.2.6-1 | not yet assigned | Not reported | Not reported |
| Debian | harfbuzz | source | trixie | 1.2.6-1 | not yet assigned | Not reported | Not reported |
| Debian | harfbuzz | source | bookworm | 1.2.6-1 | not yet assigned | Not reported | Not reported |
| Ubuntu | harfbuzz | deb | pro | 1.0.1-1ubuntu0.1+esm1 | Not reported | USN-5746-1 | Not reported |
| Ubuntu | harfbuzz | deb | pro | 1.0.1-1ubuntu0.1+esm1 | Not reported | UBUNTU-CVE-2015-9274 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [gir1.2-harfbuzz-0.0]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· amd64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· arm64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- [libharfbuzz0b]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· amd64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· arm64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- [libharfbuzz-bin]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· amd64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· arm64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- [libharfbuzz-dev]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· amd64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· arm64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- [libharfbuzz-doc]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· all · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· all · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- [libharfbuzz-gobject0]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· amd64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· arm64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- [libharfbuzz-icu0]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· amd64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· arm64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- [libharfbuzz-subset0]Fixed
Source package: [harfbuzz]
Details (2)
6.0.0+dfsg-3· amd64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
6.0.0+dfsg-3· arm64 · bookwormFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[Debian 13 (Trixie)]
- [gir1.2-harfbuzz-0.0]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz0b]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz-bin]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz-cairo0]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz-dev]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz-doc]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· all · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· all · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz-gobject0]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz-icu0]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
- [libharfbuzz-subset0]Fixed
Source package: [harfbuzz]
Details (2)
10.2.0-1+deb13u1· amd64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
10.2.0-1+deb13u1· arm64 · trixieFixed · Fixed:
1.2.6-1dsa · harfbuzz · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2015-9274]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2015-9274]
- [https://osv.dev/vulnerability/USN-5746-1]
- [https://security-tracker.debian.org/tracker/CVE-2015-9274]
- [https://security.access.redhat.com/data/csaf/v2/vex/2015/cve-2015-9274.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]