9 results · Feed
-
High 7.3
libass: Out-of-bounds read and write in wrap_lines_measure
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap…
-
High 7.3
libass: Out-of-bounds bit clears for negative Matroska ReadOrder values
libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker to clear arbitrarily …
-
High 7.5
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in li…
-
Unscored —
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text)…
-
Unscored —
Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause…
-
Unscored —
In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow.
-
Unscored —
Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to caus…
-
Unscored —
The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of serv…
-
Unscored —
The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial…