A vulnerability has been found in libass that could allow a remote attacker to execute arbitrary code.
|Package||media-libs/libass on all architectures|
|Affected versions||< 0.15.0|
|Unaffected versions||>= 0.15.0|
libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format.
It was discovered that libass did not properly handle Advanced Substation Alpha/Substation Alpha subtitle format files.
A remote attacker could entice a user to process an a specially crafted subtitle format file using an application linked against libass, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All libass users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libass-0.15.0"
December 23, 2020
December 23, 2020: 1