CVE-2017-12963
HighSummary
There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack.
Risk Assessment
An attacker can exploit this vulnerability to remotely disrupt service, potentially causing downtime for applications using LibSass.
Recommendation
It is recommended to update LibSass to the latest version to mitigate this vulnerability and to monitor systems for potential attacks.
Other vulnerabilities in LibSass 3.4.5
See all- CVE-2017-12964High
There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.
- CVE-2017-12962High
LibSass version 3.4.5 has memory leaks triggered by deeply nested code, such as code with a long sequence of open parenthesis characters, leading to a remote denial of service attack.
- CVE-2017-11556High
There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A crafted input may lead to remote denial of service.
- CVE-2017-11555High
There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service.
- CVE-2017-11554High
There is a stack consumption vulnerability in the lex function in parser.hpp in LibSass version 3.4.5, which can lead to remote denial of service through crafted input.
- CVE-2017-11342High
There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.
- CVE-2017-11341High
There is a heap based buffer over-read vulnerability in LibSass version 3.4.5 that can be exploited by crafted input.
- CVE-2017-10687High
In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted input will lead to a remote denial of service attack.
Original NVD description (English source)
There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but remains exploitable after the vendor's CVE-2017-11555 fix (available from GitHub after 2017-07-24).