Denial of Service Vulnerability in libass Package
Summary
ALPINE-CVE-2016-7972: The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors. Affects libass versions < 0.13.4-r0. Fixed in 0.13.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libass is a library for rendering subtitles, primarily used in video players and media applications. It provides advanced features for subtitle styling and positioning, making it a popular choice among developers. However, prior to version 0.13.4, libass contained a vulnerability that could lead to memory allocation failures, potentially affecting the stability of applications that rely on it.
Vulnerability Detail
The vulnerability identified as CVE-2016-7972 exists in the check_allocations function within libass/ass_shaper.c. This flaw allows remote attackers to exploit unspecified vectors, leading to a denial of service condition due to memory allocation failures. The vulnerability has a CVSS score of 7.5, indicating a high severity level, which could result in application crashes or unresponsive behavior, impacting user experience significantly.
How To Fix
Minimum fixed version
0.13.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade libassTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider implementing input validation to restrict the types of data processed by libass, thereby reducing the risk of triggering the vulnerability.
Conclusion
The CVE-2016-7972 vulnerability in the libass package poses a significant risk of denial of service due to memory allocation failures. It is crucial for developers and system administrators to update to the patched version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for libass →
FAQ
CVE-2016-7972 is a vulnerability in the libass library that can lead to denial of service due to memory allocation failures.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2016-7972 is 7.5, indicating a high severity level.
The vulnerability can cause applications that use libass to crash or become unresponsive, negatively affecting user experience.
Yes, the vulnerability is patched in libass version 0.13.4 and later. It is recommended to update to this version or higher.
References
Related vulnerabilities
Recent vulnerabilities recorded for libass.
