Heap-based buffer overflow in libass - CVE-2020-36430

Vulnerability identifier: #VU56056

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-36430

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in decode_chars (called from decode_font and process_text). A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libass
Gentoo Linux
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Desktop Applications
openEuler
Fedora
libass-debugsource
libass-devel
libass9
libass9-debuginfo
libass
libass-debuginfo
libass-help
media-libs/libass

Install update from vendor's website.

libass - update to 0.15.1
libass-debugsource - update to 0.14.0-3.9.1
libass-devel - update to 0.14.0-3.9.1
libass9 - update to 0.14.0-3.9.1
libass9-debuginfo - update to 0.14.0-3.9.1
libass - update to 0.15.0-2
libass-debuginfo - update to 0.15.0-2
libass-debugsource - update to 0.15.0-2
libass-devel - update to 0.15.0-2
libass-help - update to 0.15.0-2
media-libs/libass - update to 0.15.1
libass - update to 0.15.2-1.fc34

• https://github.com/libass/libass/commit/017137471d0043e0321e377ed8da48e45a3ec632
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674

• Remote code execution in libass
• SUSE update for libass
• Gentoo update for libass
• openEuler 20.03 LTS SP2 update for libass
• Fedora 34 update for libass