CVE-2023-25193

commit 85be877925ddbf34f74a1229f3ca1716bb6170dc that was
claimed to fix the issue, got reverted in commit
661050b4659ee490dfe622821bc7fde7d1c40510, there are comments on the first
discussing possible regressions. Instead, the commits listed in the
patches section seems to properly fix the issue.
for commit 30b84faba, _infos_set_glyph_flags() can be
found as _unsafe_to_break_set_mask() for versios prior to 3.3.0, down to
version 1.5.0, where the later was added.
GPOS lookups (src/OT/Layout/GPOS) moved to the current
code baseline in version 4.4.1, before it, some of the methods can be
found in src/hb-ot-layout-gsubgpos.hh.
releases prior to bionic does not have any of the code
being fixed. bionic itself could be patched with some of the commits, but
not all. a careful check seems necessary to evaluate if really possible
to fix it.