Debian Package Tracker
Register | Log in
Subscribe

harfbuzz

Choose email to subscribe with

general
  • source: harfbuzz (main)
  • version: 12.3.0-4
  • maintainer: أحمد المحمودي (Ahmed El-Mahmoudy) (DMD)
  • uploaders: Emilio Pozuelo Monfort [DMD]
  • arch: all any
  • std-ver: 4.7.3
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 2.7.4-1
  • oldstable: 6.0.0+dfsg-3
  • stable: 10.2.0-1
  • testing: 12.2.0-1
  • unstable: 12.3.0-4
versioned links
  • 2.7.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.0.0+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 10.2.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 12.2.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 12.3.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 12.3.0-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • gir1.2-harfbuzz-0.0
  • libharfbuzz-bin
  • libharfbuzz-cairo0
  • libharfbuzz-dev (2 bugs: 0, 2, 0, 0)
  • libharfbuzz-doc
  • libharfbuzz-gobject0
  • libharfbuzz-icu0
  • libharfbuzz-subset0
  • libharfbuzz0-udeb
  • libharfbuzz0b (1 bugs: 0, 1, 0, 0)
action needed
1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:
  • CVE-2026-22693:
Created: 2026-01-10 Last update: 2026-01-11 03:00
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2026-22693:
Created: 2026-01-10 Last update: 2026-01-11 03:00
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2026-22693:
Created: 2026-01-10 Last update: 2026-01-11 03:00
3 security issues in bullseye high

There are 3 open security issues in bullseye.

1 important issue:
  • CVE-2026-22693:
2 issues postponed or untriaged:
  • CVE-2022-33068: (needs triaging) An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
  • CVE-2023-25193: (needs triaging) hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
Created: 2026-01-10 Last update: 2026-01-11 03:00
2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:
  • CVE-2026-22693:
1 issue left for the package maintainer to handle:
  • CVE-2023-25193: (needs triaging) hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-06-10 Last update: 2026-01-11 03:00
lintian reports 7 errors and 2 warnings high
Lintian reports 7 errors and 2 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2025-10-02 Last update: 2026-01-08 00:30
1 bug tagged patch in the BTS normal
The BTS contains patches fixing 1 bug, consider including or untagging them.
Created: 2025-01-06 Last update: 2026-01-11 04:00
1 open merge request in Salsa normal
There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.
Created: 2025-08-19 Last update: 2025-08-19 06:28
testing migrations
  • This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
  • excuses:
    • Migration status for harfbuzz (12.2.0-1 to 12.3.0-4): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
    • Issues preventing migration:
    • ∙ ∙ Missing build on riscv64
    • ∙ ∙ Piuparts check waiting for test results - https://piuparts.debian.org/sid/source/h/harfbuzz.html
    • ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
    • ∙ ∙ Autopkgtest for ffmpeg: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for fonts-rit-sundar: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for gimp: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered
    • ∙ ∙ Autopkgtest for gtk+3.0: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for gtk4: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for harfbuzz: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for kicad: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered
    • ∙ ∙ Autopkgtest for libharfbuzz-shaper-perl: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for libreoffice: amd64: Test triggered (will not be considered a regression) ♻ (reference ♻), arm64: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for librsvg: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for libsdl2-ttf: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for libsdl3-ttf: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for mutter: amd64: Test triggered (failure will be ignored), arm64: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Test triggered (failure will be ignored), s390x: Test triggered (failure will be ignored)
    • ∙ ∙ Autopkgtest for opencv: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for openjdk-21: amd64: Test triggered (failure will be ignored), arm64: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Test triggered (failure will be ignored), s390x: Test triggered (failure will be ignored)
    • ∙ ∙ Autopkgtest for openjdk-25: amd64: Test triggered (failure will be ignored), arm64: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Test triggered (failure will be ignored), s390x: Test triggered (failure will be ignored)
    • ∙ ∙ Autopkgtest for openjdk-26: amd64: Test triggered (failure will be ignored), arm64: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Test triggered (failure will be ignored), s390x: Test triggered (failure will be ignored)
    • ∙ ∙ Autopkgtest for openscad: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for pango1.0: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for plantuml: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for r-cran-textshaping: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for raqm: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for rust-gdk-0.18: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for rust-pango-sys-0.18: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for vlc: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for xmobar: amd64: Test triggered, arm64: Test triggered, i386: Test triggered, ppc64el: Test triggered, s390x: Test triggered (will not be considered a regression) ♻ (reference ♻)
    • ∙ ∙ Lintian check waiting for test results - info
    • ∙ ∙ Too young, only 0 of 5 days old
    • Additional info (not blocking):
    • ∙ ∙ Waiting for reproducibility test results on amd64 - info ♻
    • ∙ ∙ Waiting for reproducibility test results on arm64 - info ♻
    • Not considered
news
[rss feed]
  • [2026-01-11] Accepted harfbuzz 12.3.0-4 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2026-01-07] Accepted harfbuzz 12.3.0-3 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2026-01-06] Accepted harfbuzz 12.3.0-2 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2026-01-05] Accepted harfbuzz 12.3.0-1 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2025-12-20] harfbuzz 12.2.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-12-20] harfbuzz 12.2.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-12-15] Accepted harfbuzz 12.2.0-1 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2025-10-07] harfbuzz 12.1.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-10-02] Accepted harfbuzz 12.1.0-1 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2025-09-18] Accepted harfbuzz 11.5.0-1 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2025-09-11] harfbuzz 11.4.5-1 MIGRATED to testing (Debian testing watch)
  • [2025-09-02] Accepted harfbuzz 11.4.5-1 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2025-01-21] harfbuzz 10.2.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-01-15] Accepted harfbuzz 10.2.0-2 (source) into experimental (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2025-01-14] Accepted harfbuzz 10.2.0-1 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2025-01-01] harfbuzz 10.1.0-2 MIGRATED to testing (Debian testing watch)
  • [2024-12-28] Accepted harfbuzz 10.1.0-2 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
  • [2024-12-12] harfbuzz 10.1.0-1 MIGRATED to testing (Debian testing watch)
  • [2024-12-07] Accepted harfbuzz 10.1.0-1 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
  • [2024-10-23] harfbuzz 10.0.1-1 MIGRATED to testing (Debian testing watch)
  • [2024-10-17] Accepted harfbuzz 10.0.1-1 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
  • [2024-08-24] harfbuzz 9.0.0-1 MIGRATED to testing (Debian testing watch)
  • [2024-08-14] Accepted harfbuzz 9.0.0-1 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
  • [2024-01-26] harfbuzz 8.3.0-2 MIGRATED to testing (Debian testing watch)
  • [2024-01-20] Accepted harfbuzz 8.3.0-2 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
  • [2024-01-20] Accepted harfbuzz 8.3.0-1 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
  • [2023-07-18] harfbuzz 8.0.1-1 MIGRATED to testing (Debian testing watch)
  • [2023-07-12] Accepted harfbuzz 8.0.1-1 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2023-07-12] Accepted harfbuzz 8.0.0-3 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • [2023-07-12] Accepted harfbuzz 8.0.0-2 (source) into unstable (أحمد المحمودي (Ahmed El-Mahmoudy)) (signed by: أحمد المحمودي)
  • 1
  • 2
bugs [bug history graph]
  • all: 5
  • RC: 0
  • I&N: 4
  • M&W: 1
  • F&P: 0
  • patch: 1
links
  • homepage
  • lintian (7, 2)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 12.3.0-3
  • 3 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing