Vulnerability · Published Jul 20, 2021 · Assigned by mitre
CVE-2020-36430
High 7.8
In plain English
A high-severity security flaw in the libass package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.1%top 34.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libass | 1:0.15.0-2 | DEBIAN-CVE-2020-36430 |
| Debian:13 | libass | 1:0.15.0-2 | DEBIAN-CVE-2020-36430 |
| Debian:14 | libass | 1:0.15.0-2 | DEBIAN-CVE-2020-36430 |
| Ubuntu:22.04:LTS | libass | 1:0.15.2-1 | UBUNTU-CVE-2020-36430 |
Affected products (as reported)
References
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml x_refsource_MISC
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674 x_refsource_MISC
- https://github.com/libass/libass/commit/017137471d0043e0321e377ed8da48e45a3ec632 x_refsource_MISC
- FEDORA-2022-2af150223a vendor-advisory, x_refsource_FEDORA
- GLSA-202208-13 vendor-advisory, x_refsource_GENTOO