CVE-2020-24994 — Allocation of Resources Without Limits or Throttling in Project Libass

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-787 — Out-of-bounds Write6 documents5 sources
Severity
8.8HIGHNVD
OSV7.5
EPSS
1.6%
top 18.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Libass Project LibassDebian Libass
Timeline
PublishedMar 23
Latest updateMay 24

Description

Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/libass< libass 1:0.15.0-1 (bookworm)
▶NVDlibass_project/libass< 0.15.0
▶Debianlibass_project/libass< 1:0.15.0-1+3
▶Ubuntulibass_project/libass< 0.10.1-3ubuntu1+esm1+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qrhf-wgfc-f8cx: Stack overflow in the parse_tag function in libass/ass_parse↗2022-05-24
▶
OSV
libass vulnerabilities↗2022-05-04
▶
OSV
CVE-2020-24994: Stack overflow in the parse_tag function in libass/ass_parse↗2021-03-23
▶

📋Vendor Advisories

2
Ubuntu
LibASS vulnerabilities↗2022-05-04
▶
Debian
CVE-2020-24994: libass - Stack overflow in the parse_tag function in libass/ass_parse.c in libass before ...↗2020
▶