CVE-2016-7969: High severity openSUSE Leap vulnerability
Libass released a new 0.13.4 version which fixes multiple issues. CVE-2016-7971 remains unfixed for now.
CVE-2016-7969 upstream patch:
https://github.com/libass/libass/pull/240/commits/b72b283b936a600c730e00875d7d067bded3fc26
CVE-2016-7970 upstream patch:
https://github.com/libass/libass/pull/240/commits/08e754612019ed84d1db0d1fc4f5798248decd75
CVE-2016-7972 upstream patch:
https://github.com/libass/libass/pull/240/commits/aa54e0b59200a994d50a346b5d7ac818ebcf2d4b
External References:
https://github.com/libass/libass/releases/tag/0.13.4
Other sources
The wraplinessmart function in assrender.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7969?
CVE-2016-7969 is classified as a moderate severity vulnerability that affects multiple versions of libass.
How do I fix CVE-2016-7969?
To fix CVE-2016-7969, upgrade to libass version 0.13.4 or later.
Which versions of software are affected by CVE-2016-7969?
CVE-2016-7969 affects libass versions up to and including 0.13.3 on systems such as Fedora 23, 24, 25, and openSUSE 13.2 and 42.1.
Is there a patch available for CVE-2016-7969?
Yes, a patch for CVE-2016-7969 is included in libass version 0.13.4.
What are the related security issues for CVE-2016-7969?
CVE-2016-7971 is a related issue that remains unfixed at this time.