Integer overflow in libass - CVE-2020-26682

Vulnerability identifier: #VU47227

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26682

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when the ass_outline_construct() function calls to the outline_stroke() function in ass_outline.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libass
Gentoo Linux
Arch Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Module for Desktop Applications
libass-debugsource
libass-devel
libass9
libass9-debuginfo

Install update from vendor's website.

libass - update to 0.15.0
libass-debugsource - update to 0.14.0-3.3.1
libass-devel - update to 0.14.0-3.3.1
libass9 - update to 0.14.0-3.3.1
libass9-debuginfo - update to 0.14.0-3.3.1

• https://github.com/libass/libass/issues/431
• https://github.com/libass/libass/pull/432

• Remote code execution in libass
• Arch Linux update for libass
• Gentoo update for libass
• SUSE update for libass