libass: User-assisted execution of arbitrary code — GLSA 202012-12

A vulnerability has been found in libass that could allow a remote attacker to execute arbitrary code.

Affected packages

Package	media-libs/libass on all architectures
Affected versions	< 0.15.0
Unaffected versions	>= 0.15.0

Background

libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format.

Description

It was discovered that libass did not properly handle Advanced Substation Alpha/Substation Alpha subtitle format files.

Impact

A remote attacker could entice a user to process an a specially crafted subtitle format file using an application linked against libass, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All libass users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-libs/libass-0.15.0"

References

CVE-2020-26682

Release date
December 23, 2020

Latest revision
December 23, 2020: 1

Severity
normal

Exploitable
local, remote

Bugzilla entries

746413