SB2017063032 - Multiple vulnerabilities in Sass LibSass

Main Vulnerability Database SB2017063032

SB2017063032 - Multiple vulnerabilities in Sass LibSass

Published: June 30, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017063032

CSH Severity

Medium

Patch available

NO

Number of vulnerabilities 11

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 11 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2017-12962)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There are memory leaks in LibSass 3.4.5 triggered by deeply nested code, such as code with a long sequence of open parenthesis characters, leading to a remote denial of service attack.

2) Out-of-bounds read (CVE-ID: CVE-2017-12963)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but remains exploitable after the vendor's CVE-2017-11555 fix (available from GitHub after 2017-07-24).

3) Uncontrolled Recursion (CVE-ID: CVE-2017-12964)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.

4) Out-of-bounds read (CVE-ID: CVE-2017-11608)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.

5) Out-of-bounds read (CVE-ID: CVE-2017-11605)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will lead to a remote denial of service attack.

6) Uncontrolled Recursion (CVE-ID: CVE-2017-11554)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4.5. A crafted input will lead to a remote denial of service.

7) Input validation error (CVE-ID: CVE-2017-11555)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service.

8) Uncontrolled Recursion (CVE-ID: CVE-2017-11556)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A crafted input may lead to remote denial of service.

9) Out-of-bounds read (CVE-ID: CVE-2017-11341)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.

10) Input validation error (CVE-ID: CVE-2017-11342)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.

11) Out-of-bounds read (CVE-ID: CVE-2017-10687)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted input will lead to a remote denial of service attack. A remote attacker can perform a denial of service attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References