CVE-2015-8947

What it actually does

The flaw permits a buffer over-read in hb-ot-layout-gpos-table.hh when processing crafted GPOS table data, resulting in denial of service or potential unspecified further impact.

Why it matters to the business

Applications that render text from untrusted fonts may crash or behave unexpectedly, interrupting services such as document viewers, browsers, or any system handling user-supplied font data.

How an attack unfolds

An attacker prepares a malicious font containing crafted GPOS table data and supplies it to a target application that uses the vulnerable HarfBuzz library. Upon parsing the font the over-read occurs, causing a crash or opening the door to additional impact.

How to fix it

Upgrade the HarfBuzz library to version 1.0.5 or later.

How to confirm the fix worked

Confirm the running HarfBuzz version is 1.0.5 or newer; test font rendering paths with known crafted inputs in an isolated environment to verify the issue is resolved.

Typical attack path

1. Create a font file embedding specially constructed GPOS table data
2. Deliver the font through web content, documents, or other channels that reach the victim application
3. Victim application loads and processes the font with the vulnerable HarfBuzz library
4. Buffer over-read is triggered, resulting in denial of service or further effects

How to detect it

Look for repeated application crashes or segmentation faults that occur immediately after loading font files; examine process logs and crash dumps for signs of over-read conditions in font parsing code.

What your security team should do

• Update HarfBuzz to 1.0.5 or later on all affected systems
• Identify and inventory applications that depend on HarfBuzz for text shaping
• Restrict processing of fonts from untrusted sources until patches are applied