Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 8 articles for you...
91
security advisorydenial of servicegentooGentoo: GLSA-202301-11 Low Severity: libxml Denial Of Service
A vulnerability in libass could result in denial of service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202208-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: libass: Denial of service Date: August 10, 2022 Bugs: #803119 ID: 202208-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in libass could result in denial of service. Background ========= libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-libs/libass < 0.15.1 > = 0.15.1 Description ========== A one-byte buffer overwrite in ASS font decoding could trigger an assertion failure resulting in denial of service. Impact ===== An attacker with control over the ASS track input to libass via an application using it could trigger a denial of service. Workaround ========= There is no known workaround at this time. Resolution ========= All libass users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-libs/libass-0.15.1" References ========= [ 1 ] CVE-2020-36430 https://nvd.nist.gov/vuln/detail/CVE-2020-36430 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202208-13 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users'machines is of utmost importance to us. Any security concerns should be addressed to
Aug 10, 2022
•Low
Gentoo
89
security advisorymoderatebuffer overflowFedora 34: FEDORA-2022-2af150223a Moderate: Libass Heap Overflow Fix
New version Security fix for CVE-2020-36430. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-2af150223a 2022-03-25 22:04:41.514595 --------------------------------------------------------------------------------Name : libass Product : Fedora 34 Version : 0.15.2 Release : 1.fc34 URL : https://github.com/libass Summary : Portable library for SSA/ASS subtitles rendering Description : Libass is a portable library for SSA/ASS subtitles rendering. --------------------------------------------------------------------------------Update Information: New version Security fix for CVE-2020-36430 --------------------------------------------------------------------------------ChangeLog: * Wed Mar 16 2022 Martin Sourada - 0.15.2-1 - New version * Thu Jul 22 2021 Fedora Release Engineering - 0.14.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1985246 - CVE-2020-36430 libass: heap-based buffer overflow in decode_chars because the wrong integer data type is used for subtraction https://bugzilla.redhat.com/show_bug.cgi?id=1985246 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-2af150223a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 25, 2022
•Important
Fedora
203
security advisorymoderateupdateMageia 8: 2021-0413 Moderate: Libass Heap-Based Overflow Fix
Updated libass packages fix security vulnerability: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction (CVE-2020-36430). . MGASA-2021-0413 - Updated libass packages fix security vulnerability Publication date: 27 Aug 2021 URL: https://advisories.mageia.org/MGASA-2021-0413.html Type: security Affected Mageia releases: 8 CVE: CVE-2020-36430 Updated libass packages fix security vulnerability: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars(called from decode_font and process_text) because the wrong integer data type is used for subtraction (CVE-2020-36430). References: - https://bugs.mageia.org/show_bug.cgi?id=29392 - https://lists.suse.com/pipermail/sle-security-updates/2021-August/009325.html - https://www.cve.org/CVERecord?id=CVE-2020-36430 SRPMS: - 8/core/libass-0.15.1-1.mga8 . The latest libass updates address a critical memory overflow vulnerability in Mageia distributions, bolstering user safety. Discover further details here.. Libass Update, Buffer Overflow Fix, Mageia Security, Heap Overflow, Security Advisory. . Severity: Important. LinuxSecurity.com Team
Aug 27, 2021
•Important
Mageia
202
security advisorysecurity updatebuffer overflowopenSUSE Leap 15.2 Security Update: libass Buffer Overflow Important Fix
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1174-1 Rating: important References: #1188539 Cross-References: CVE-2020-36430 CVSS scores: CVE-2020-36430 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-36430 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-36430: Fixed heap-based buffer overflow in decode_chars (bsc#1188539). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1174=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libass-debugsource-0.14.0-lp152.4.9.1 libass-devel-0.14.0-lp152.4.9.1 libass9-0.14.0-lp152.4.9.1 libass9-debuginfo-0.14.0-lp152.4.9.1 - openSUSE Leap 15.2 (x86_64): libass9-32bit-0.14.0-lp152.4.9.1 libass9-32bit-debuginfo-0.14.0-lp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-36430.html https://bugzilla.suse.com/1188539 . Addresses a critical heap overflow vulnerability in libass with a significant security patch for openSUSE Leap 15.2.. openSUSE Security Update, libass Buffer Overflow, security patch. . Severity: Important. LinuxSecurity.com Team
Aug 21, 2021
•Important
OpenSUSE
202
security advisorybuffer overflowsoftware updateopenSUSE Leap 15.3: 2021:2792-1 Important Libass Buffer Overflow
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2792-1 Rating: important References: #1188539 Cross-References: CVE-2020-36430 CVSS scores: CVE-2020-36430 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-36430 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-36430: Fixed heap-based buffer overflow in decode_chars (bsc#1188539). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2792=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libass-debugsource-0.14.0-3.9.1 libass-devel-0.14.0-3.9.1 libass9-0.14.0-3.9.1 libass9-debuginfo-0.14.0-3.9.1 - openSUSE Leap 15.3 (x86_64): libass9-32bit-0.14.0-3.9.1 libass9-32bit-debuginfo-0.14.0-3.9.1 References: https://www.suse.com/security/cve/CVE-2020-36430.html https://bugzilla.suse.com/1188539 . This crucial Fedora security patch tackles a stack overflow vulnerability in libfoo, improving overall system resilience.. OpenSUSE Security Update, Libass Patch, Buffer Overflow Fix. . Severity: Important. LinuxSecurity.com Team
Aug 20, 2021
•Important
OpenSUSE
202
security advisorysoftware updatesecurity fixopenSUSE Leap 15.3 Security: 2021:1664-1 Moderate Stack Overflow Fix
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1664-1 Rating: moderate References: #1184153 Cross-References: CVE-2020-24994 CVSS scores: CVE-2020-24994 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-24994: Fixed a stack overflow in the parse_tag (bsc#1184153). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1664=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libass-debugsource-0.14.0-3.6.1 libass-devel-0.14.0-3.6.1 libass9-0.14.0-3.6.1 libass9-debuginfo-0.14.0-3.6.1 - openSUSE Leap 15.3 (x86_64): libass9-32bit-0.14.0-3.6.1 libass9-32bit-debuginfo-0.14.0-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-24994.html https://bugzilla.suse.com/1184153 . A vital security patch for openSUSE addressing a critical stack overflow in libass has been released. Users are urged to apply it promptly to mitigate risks.. openSUSE update, libass security fix, stack overflow, security patches, openSUSE Leap. . LinuxSecurity.com Team
Jul 10, 2021
OpenSUSE
202
security advisorymoderatesoftware patchopenSUSE: 2021:0774-2 Critical: Libpng Buffer Overflow Advisory
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0773-1 Rating: moderate References: #1184153 Cross-References: CVE-2020-24994 CVSS scores: CVE-2020-24994 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-24994: Fixed a stack overflow in the parse_tag (bsc#1184153). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-773=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libass-debugsource-0.14.0-lp152.4.6.1 libass-devel-0.14.0-lp152.4.6.1 libass9-0.14.0-lp152.4.6.1 libass9-debuginfo-0.14.0-lp152.4.6.1 - openSUSE Leap 15.2 (x86_64): libass9-32bit-0.14.0-lp152.4.6.1 libass9-32bit-debuginfo-0.14.0-lp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-24994.html https://bugzilla.suse.com/1184153 . The recent security patch from openSUSE addresses a critical stack overflow issue in Libass. Users are advised to follow the outlined installation steps to ensure their systems are secure.. openSUSE Update, Libass Security, Stack Overflow Fix, Vulnerability Management. . LinuxSecurity.com Team
May 23, 2021
OpenSUSE
100
security advisorymoderateSUSE LinuxSUSE: 2021:1664-1 Moderate: libass Stack Overflow Security Patch
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:1664-1 Rating: moderate References: #1184153 Cross-References: CVE-2020-24994 CVSS scores: CVE-2020-24994 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-24994: Fixed a stack overflow in the parse_tag (bsc#1184153). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2021-1664=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP2: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP2-2021-1664=1 Package List: - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libass-debugsource-0.14.0-3.6.1 libass-devel-0.14.0-3.6.1 libass9-0.14.0-3.6.1 libass9-debuginfo-0.14.0-3.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (aarch64 ppc64le s390x x86_64): libass-debugsource-0.14.0-3.6.1 libass-devel-0.14.0-3.6.1 libass9-0.14.0-3.6.1 libass9-debuginfo-0.14.0-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-24994.html https://bugzilla.suse.com/1184153 . A balanced SUSE securitypatch for libass rectifies stack overflow risks, accompanied by update guidelines.. SUSE Update, libass Security, Moderate Rating, Stack Overflow, Package Fix. . LinuxSecurity.com Team
May 20, 2021
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!