Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6 were found, as used in Google Chrome before 48.0.2564.82, allowing attackers to cause a denial of service or possibly have other impact via unknown vectors. Upstream tracking bug: https://code.google.com/p/chromium/issues/detail?id=544270
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2016:0072 https://rhn.redhat.com/errata/RHSA-2016-0072.html
This CVE was assigned to "Update harfbuzz to 1.0.6" in chromium browser. (As referenced by the comment #0 above). When investigating this issue it seems all the issues fixed in 1.0.5 and subsequent 1.0.6 are linked to their fuzzing initiative as obvious from https://github.com/behdad/harfbuzz/issues/139. Several flaws were fixed, which include: Several heap-based buffer overflows at: https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679 https://github.com/behdad/harfbuzz/issues/139#issuecomment-147616887 https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957 https://github.com/behdad/harfbuzz/issues/156 And a few other assorted flaws (some of them may have a non-security impact)
Send a CVE request to MITRE at: http://www.openwall.com/lists/oss-security/2016/07/14/1
CVE-2015-8947 was assigned by MITRE: http://seclists.org/oss-sec/2016/q3/107 to issue fixed by following commit: https://github.com/behdad/harfbuzz/commit/f96664974774bfeb237a7274f512f64aaafb201e
Further to comment #5, the following commit was assigned to CVE-2016-2052: https://github.com/behdad/harfbuzz/commit/63ef0b41dc48d6112d1918c1b1de9de8ea90adb5 while CVE-2015-8947 has been assigned to: https://github.com/behdad/harfbuzz/commit/f96664974774bfeb237a7274f512f64aaafb201e
Created mingw-harfbuzz tracking bugs for this issue: Affects: fedora-all [bug 1358576]
Created harfbuzz tracking bugs for this issue: Affects: fedora-all [bug 1358575] Affects: epel-7 [bug 1358577]