ArchLinux: 202011-19: libass: arbitrary code execution
Summary
In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.
Resolution
Upgrade to 0.15.0-1.
# pacman -Syu "libass>=0.15.0-1"
The problem has been fixed upstream in version 0.15.0.
References
https://github.com/libass/libass/issues/431 https://github.com/libass/libass/pull/432 https://github.com/libass/libass/commit/676f9dc5b52ef406c5527bdadbcb947f11392929 https://security.archlinux.org/CVE-2020-26682
Workaround
None.