libass: User-assisted execution of arbitrary code

Background

libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format.

Description

It was discovered that libass did not properly handle Advanced Substation Alpha/Substation Alpha subtitle format files.

Impact

A remote attacker could entice a user to process an a specially crafted subtitle format file using an application linked against libass, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All libass users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-libs/libass-0.15.0"