PatchTheCVElibass project vulnerabilities
Recent CVEs affecting libass project products. 6 tracked.
libass project has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2021-07-20. Highest priority: CVE-2020-26682 (score 55/100).
- CVE-2020-36430 HIGH 7.8 UPGRADE MITIGATE libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and proc
- CVE-2020-26682 HIGH 8.8 DOWNGRADE In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow.
- CVE-2020-24994 HIGH 8.8 UPGRADE Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers
- CVE-2016-7972 HIGH 7.5 MITIGATE MITIGATE The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause
- CVE-2016-7970 HIGH 7.5 MITIGATE UPGRADE Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attacker
- CVE-2016-7969 HIGH 7.5 MITIGATE MITIGATE The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denia
FAQ
How do I fix libass project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libass project being exploited right now?
None of the tracked libass project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libass project CVE should I patch first?
CVE-2020-26682 currently ranks highest (55/100): In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow..