Bug 803119 – <media-libs/libass-0.15.1: 1 byte heap overflow (CVE-2020-36430)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2021-07-20 23:05:02 UTC]

CVE-2020-36430 (https://github.com/libass/libass/commit/017137471d0043e0321e377ed8da48e45a3ec632):

libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.

Seems like this was indeed fixed in 0.15.1, so please cleanup.

[Comment 1 Larry the Git Cow 2021-07-26 03:25:03 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c4bd74eb575a63959f5496507b6495bb895b6a38

commit c4bd74eb575a63959f5496507b6495bb895b6a38
Author:     John Helmert III <[e-mail]>
AuthorDate: 2021-07-25 21:26:52 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2021-07-26 03:13:01 +0000

    media-libs/libass: drop 0.15.0
    
    Bug: https://bugs.gentoo.org/803119
    Signed-off-by: John Helmert III <[e-mail]>

 media-libs/libass/Manifest             |  1 -
 media-libs/libass/libass-0.15.0.ebuild | 42 ----------------------------------
 2 files changed, 43 deletions(-)

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-07-29 17:20:50 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-29 17:28:56 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:36:53 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 17:44:55 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(6, 1, 'Toggle comment display'); Comment 6 NATTkA bot 2021-07-29 17:52:59 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-07-29 17:56:54 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(8, 1, 'Toggle comment display'); Comment 8 NATTkA bot 2021-07-29 18:00:54 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 9 NATTkA bot 2021-07-29 18:09:12 UTC]

Package list is empty or all packages have requested keywords.

[Comment 10 John Helmert III 2022-08-09 22:10:35 UTC]

GLSA request filed.

[Comment 11 Larry the Git Cow 2022-08-10 04:18:38 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=d7329b83bbe97f0a26668c688489b9caf15179c3

commit d7329b83bbe97f0a26668c688489b9caf15179c3
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-10 04:08:39 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-10 04:17:34 +0000

    [ GLSA 202208-13 ] libass: Denial of service
    
    Bug: https://bugs.gentoo.org/803119
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-13.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

[Comment 12 John Helmert III 2022-08-10 04:26:14 UTC]

GLSA released, all done!