CVE-2016-7970 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libass

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents6 sources
Severity
7.5HIGHNVD
EPSS
1.3%
top 20.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libass Project LibassDebian LibassFedoraproject Fedora
Timeline
PublishedMar 3
Latest updateMay 17

Description

Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/libass< libass 0.13.4-1 (bookworm)
▶Debianlibass_project/libass< 0.13.4-1+3
▶Ubuntulibass_project/libass< 0.10.1-3ubuntu1+esm1+1

Also affects: Fedora 23, 24, 25

Patches

Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-5phf-q389-vx4x: Buffer overflow in the calc_coeff function in libass/ass_blur↗2022-05-17
▶
OSV
libass vulnerabilities↗2022-05-04
▶
OSV
CVE-2016-7970: Buffer overflow in the calc_coeff function in libass/ass_blur↗2017-03-03
▶

📋Vendor Advisories

2
Ubuntu
LibASS vulnerabilities↗2022-05-04
▶
Debian
CVE-2016-7970: libass - Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-7969 CVE-2016-7970 CVE-2016-7971 CVE-2016-7972 libass: Multiple issues disclosed with 0.13.4 update [epel-all]↗2016-10-05
▶
Bugzilla
CVE-2016-7969 CVE-2016-7970 CVE-2016-7971 CVE-2016-7972 libass: Multiple issues disclosed with 0.13.4 update [fedora-all]↗2016-10-05
▶