[ GLSA 202012-12 ] libass

[GLSA]

Gentoo Linux Security Advisory

Title: libass: User-assisted execution of arbitrary code (GLSA 202012-12)
Severity: normal
Exploitable: local, remote
Date: 2020-12-23
Bug(s): #746413
ID: 202012-12

Synopsis

A vulnerability has been found in libass that could allow a remote
attacker to execute arbitrary code.


Background

libass is a portable subtitle renderer for the ASS/SSA (Advanced
Substation Alpha/Substation Alpha) subtitle format.


Affected Packages

Package: media-libs/libass
Vulnerable: < 0.15.0
Unaffected: >= 0.15.0
Architectures: All supported architectures


Description

It was discovered that libass did not properly handle Advanced
Substation Alpha/Substation Alpha subtitle format files.


Impact

A remote attacker could entice a user to process an a specially crafted
subtitle format file using an application linked against libass, possibly
resulting in execution of arbitrary code with the privileges of the
process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All libass users should upgrade to the latest version: