Lucene search

Gentoo FoundationMGASA-2021-0413

HistoryAug 27, 2021 - 6:29 p.m.

Updated libass packages fix security vulnerability

2021-08-2718:29:51

Gentoo Foundation

advisories.mageia.org

libass vulnerability fix heap-based buffer overflow buffer overflow decode_chars cve-2020-36430 unixpackagenameunix

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.8%

JSON

Updated libass packages fix security vulnerability: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction (CVE-2020-36430).

OSVersionArchitecturePackageVersionFilename
Mageia8noarchlibass< 0.15.1-1libass-0.15.1-1.mga8

OS	Version	Architecture	Package	Version	Filename
Mageia	8	noarch	libass	< 0.15.1-1	libass-0.15.1-1.mga8

References

bugs.mageia.org/show_bug.cgi?id=29392

lists.suse.com/pipermail/sle-security-updates/2021-August/009325.html

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.8%

JSON

Related for MGASA-2021-0413