PT-2021-11098 · Libass+4 · Libsass+4

Fstark-Prog · Published 2018-01-03 · Updated 2022-07-22 · CVE-2020-24994

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: libass versions prior to 0.15.0

Description: The issue is related to a stack overflow in the parse tag function in libass/ass parse.c. This allows remote attackers to cause a denial of service or potentially execute remote code via a crafted file.

Recommendations: For versions prior to 0.15.0, update to version 0.15.0 or later to resolve the issue. As a temporary workaround, consider restricting access to files that could be used to exploit this issue until a patch is applied.

Fix

RCE

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2020-3253

ALT-PU-2020-3292

ALT-PU-2021-2147

BDU:2025-03974

CVE-2020-24994

OPENSUSE-SU-2021:0773-1

OPENSUSE-SU-2021:1664-1

OPENSUSE-SU-2021_0773-1

OPENSUSE-SU-2021_1664-1

SUSE-SU-2021:1664-1

SUSE-SU-2021_1664-1

USN-4797-1

Affected Products

Alt Linux

Astra Linux

Suse

Ubuntu

Libsass

References · 30

• https://github.com/libass/libass/issues/422#issuecomment-806002919 · Patch
• https://github.com/libass/libass/commit/6835731c2fe4164a0c50bc91d12c43b2a2b4e · Patch
• https://github.com/libass/libass/issues/422 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-24994 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24994 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24994 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24994 · Security Note
• https://osv.dev/vulnerability/USN-4797-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7970 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24994 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03974 · Security Note
• https://ubuntu.com/security/CVE-2016-7972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24994 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0773-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1664-1 · Vendor Advisory