CVE-2016-7969

The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."

The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."

Amount of memory allocated during memory reallocation in the shaper wasn't tracked, possibly resulting in undefined behavior (CVE-2016-7972).

Illegal read in Gaussian blur coefficient calculations (CVE-2016-7970).

Mode 0/3 line wrapping equalization in specific cases could result in illegal reads while laying out and shaping text. (CVE-2016-7969)

The libass package has been updated to version 0.13.4, fixing this issue and several other bugs.

These are all security issues fixed in the libass-devel-0.13.4-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libass fixes the following issues:

CVE-2016-7969, CVE-2016-7970, CVE-2016-7971, CVE-2016-7972: Fixed multiple memory allocation issues found by fuzzing (bsc#1002982).

It was discovered that LibASS incorrectly handled certain ASS files. A remote attacker could possibly use this issue to cause a denial of service. One of the issues, CVE-2016-7970, only affected Ubuntu 16.04 ESM. (CVE-2016-7969, CVE-2016-7970, CVE-2016-7972)

It was discovered that LibASS incorrectly handled parsing operations for specific nested character strings. An attacker could possibly use this issue to cause a denial of service. This issue was only fixed in Ubuntu 16.04 LTS. (CVE-2020-24994)