CVE catalog

CVE-2022-33068

harfbuzz: CVE-2022-33068

Severity: High · CVSS 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published: Jun 23, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.19% · Oct 25, 2026

An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	harfbuzz	sid	`12.3.2-2`	fixed
Debian	harfbuzz	forky	`12.3.2-2`	fixed
Debian	harfbuzz	trixie	`10.2.0-1+deb13u1`	fixed
Debian	harfbuzz	bookworm	`6.0.0+dfsg-3`	fixed
Ubuntu	harfbuzz	20.04	`2.6.1-3`	vulnerable
Ubuntu	harfbuzz	20.04	`2.6.2-1`	vulnerable
Ubuntu	harfbuzz	20.04	`2.6.4-1`	vulnerable
Ubuntu	harfbuzz	20.04	`2.6.4-1ubuntu1`	vulnerable
Ubuntu	harfbuzz	20.04	`2.6.4-1ubuntu2`	vulnerable
Ubuntu	harfbuzz	20.04	`2.6.4-1ubuntu3`	vulnerable
Ubuntu	harfbuzz	20.04	`2.6.4-1ubuntu4`	vulnerable
Ubuntu	harfbuzz	20.04	`2.6.4-1ubuntu4.2`	fixed
Ubuntu	harfbuzz	22.04	`2.7.4-1ubuntu1`	vulnerable
Ubuntu	harfbuzz	22.04	`2.7.4-1ubuntu2`	vulnerable
Ubuntu	harfbuzz	22.04	`2.7.4-1ubuntu3`	vulnerable
Ubuntu	harfbuzz	22.04	`2.7.4-1ubuntu3.1`	fixed
Suse	harfbuzz	linux enterprise module for basesystem 15 sp4	`3.4.0-150400.3.3.1`	fixed
Opensuse	harfbuzz	leap 15.4	`3.4.0-150400.3.3.1`	fixed
Opensuse	harfbuzz	tumbleweed	`4.4.1-1.1`	fixed
Suse	harfbuzz	linux enterprise module for basesystem 15 sp3	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	linux enterprise high performance computing 15 sp2-espos	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	linux enterprise high performance computing 15 sp2-ltss	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	linux enterprise server 15 sp2-bcl	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	linux enterprise server 15 sp2-ltss	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	linux enterprise server for sap applications 15 sp2	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	manager proxy 4.1	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	manager retail branch server 4.1	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	manager server 4.1	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	linux enterprise micro 5.2	`2.6.4-150200.3.3.1`	fixed
Suse	harfbuzz	enterprise storage 7	`2.6.4-150200.3.3.1`	fixed
Opensuse	harfbuzz	leap 15.3	`2.6.4-150200.3.3.1`	fixed
Opensuse	harfbuzz	leap micro 5.2	`2.6.4-150200.3.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	harfbuzz	source	sid	`5.2.0-2`	not yet assigned	Not reported	[1013673]
Debian	harfbuzz	source	forky	`5.2.0-2`	not yet assigned	Not reported	[1013673]
Debian	harfbuzz	source	trixie	`5.2.0-2`	not yet assigned	Not reported	[1013673]
Debian	harfbuzz	source	bookworm	`5.2.0-2`	not yet assigned	Not reported	[1013673]
Ubuntu	harfbuzz	deb	20.04	`2.6.4-1ubuntu4.2`	Not reported	USN-5524-1	Not reported
Ubuntu	harfbuzz	deb	22.04	`2.7.4-1ubuntu3.1`	Not reported	USN-5524-1	Not reported
Suse	harfbuzz	rpm	linux enterprise module for basesystem 15 sp4	`3.4.0-150400.3.3.1`	Not reported	SUSE-SU-2022:2664-1	Not reported
Opensuse	harfbuzz	rpm	leap 15.4	`3.4.0-150400.3.3.1`	Not reported	SUSE-SU-2022:2664-1	Not reported
Opensuse	harfbuzz	rpm	tumbleweed	`4.4.1-1.1`	Not reported	OPENSUSE-SU-2024:12168-1	Not reported
Suse	harfbuzz	rpm	linux enterprise module for basesystem 15 sp3	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	linux enterprise high performance computing 15 sp2-espos	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	linux enterprise high performance computing 15 sp2-ltss	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	linux enterprise server 15 sp2-bcl	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	linux enterprise server 15 sp2-ltss	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	linux enterprise server for sap applications 15 sp2	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	manager proxy 4.1	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	manager retail branch server 4.1	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	manager server 4.1	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	linux enterprise micro 5.2	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Suse	harfbuzz	rpm	enterprise storage 7	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Opensuse	harfbuzz	rpm	leap 15.3	`2.6.4-150200.3.3.1`	Not reported	SUSE-SU-2022:2663-1	Not reported
Opensuse	harfbuzz	rpm	leap micro 5.2	`2.6.4-150200.3.3.1`	Not reported	OPENSUSE-SU-2022:2663-1	Not reported

[Debian bug #1013673]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[harfbuzz-devel]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[harfbuzz-tools]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-cairo0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-cairo0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-gobject0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-gobject0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-gpu0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-icu0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-icu0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-raster0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-subset0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-subset0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-vector0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[typelib-1_0-HarfBuzz-0_0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.4.1-1.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[gir1.2-harfbuzz-0.0]Fixed
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm
- 6.0.0+dfsg-3 · arm64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm
[libharfbuzz0b]Fixed
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm
- 6.0.0+dfsg-3 · arm64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm
[libharfbuzz-bin]Fixed
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm
- 6.0.0+dfsg-3 · arm64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm
[libharfbuzz-dev]Fixed
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm
- 6.0.0+dfsg-3 · arm64 · bookworm
  Fixed · Fixed: 5.2.0-2
  dsa · harfbuzz · debian · bookworm

Next results

Observed: Oct 23, 2026, 6:27:51 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]