Out-of-bounds Read Vulnerability in libass
Summary
CVE-2016-7969: The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization.". Affects libass across 3 version ranges.
< 0.13.4-r0
< 8551555c86f50f978f9ddd55a8d20bceb80d92fc
< f4f48950788b91c6a30029cc28a240b834713ea7
Fixed in 0.13.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libass is an open-source library used for rendering subtitles in multimedia applications. It provides functionality for rendering text with various formatting options. However, a vulnerability has been discovered in versions prior to 0.13.4 that can lead to an out-of-bounds read.
Vulnerability Detail
The vulnerability, identified as CVE-2016-7969, exists in the wrap_lines_smart function of the libass library. It can be exploited by remote attackers through unspecified vectors related to '0/3 line wrapping equalization.' By exploiting this vulnerability, an attacker can cause a denial of service by triggering an out-of-bounds read.
How To Fix
Minimum fixed version
0.13.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade libassTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The out-of-bounds read vulnerability in libass can be mitigated by updating the library to version 0.13.4 or later. It is recommended to follow the provided fix instructions and ensure that the updated version is installed to prevent potential exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libass →
FAQ
libass is an open-source library used for rendering subtitles in multimedia applications. It provides functionality for rendering text with various formatting options.
The vulnerability can be exploited by remote attackers to cause a denial of service by triggering an out-of-bounds read.
To fix this vulnerability, update libass to version 0.13.4 or later by downloading the updated version from the official libass GitHub repository.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability in the official CVE-2016-7969 JSON report: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7969.json
Related vulnerabilities
Recent vulnerabilities recorded for libass.
