HarfBuzz::Shaper Null Pointer Dereference Vulnerability in Perl

A null pointer dereference vulnerability has been identified in HarfBuzz::Shaper versions prior to 0.032 for Perl. This vulnerability arises from a failure to properly check memory allocation results, allowing a null pointer to be used incorrectly, which can lead to undefined behavior and a segmentation fault. The issue is present in the bundled HarfBuzz library, specifically versions through 8.4.0, and is located in the SubtableUnicodesCache::create function within the cmap table handling.

Impact

Exploitation of this vulnerability causes a null pointer dereference, leading to a segmentation fault and denial of service condition.

Remediation

Users can upgrade to HarfBuzz::Shaper version 0.032 or later to address this vulnerability. Instructions for updating can be found on the Fedora Project's Bodhi update system.