Resource management error in libcroco - CVE-2017-8871

Vulnerability identifier: #VU19191

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-8871

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop and CPU consumption in the "cr_parser_parse_selector_core" function, as defined in the "src/cr-parser.c" file . A remote attacker can persuade a user to access a file that submits malicious input to the system and cause a DoS condition.

libcroco
Isolation Segment
VMware Tanzu Application Service for VMs
libcroco (Alpine package)
libcroco-tools (Ubuntu package)
libcroco3 (Ubuntu package)
Ubuntu
Opensuse
VMware Tanzu Operations Manager

Install updates from vendor's website.

libcroco - update to 0.6.13
libcroco (Alpine package) - addressed in versions 0.6.12-r1, 0.6.12-r2, 0.6.13-r1
libcroco-tools (Ubuntu package) - addressed in versions Ubuntu Pro, 0.6.13-1ubuntu0.1, 0.6.111ubuntu0.1~esm1
libcroco3 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.6.13-1ubuntu0.1, 0.6.111ubuntu0.1~esm1
VMware Tanzu Operations Manager - addressed in versions 2.9.39, 2.10.40

• Exploit #1437 - libcroco 0.6.12 - Denial of Service (March 18, 2020)

• https://bugzilla.gnome.org/show_bug.cgi?id=782649

• OpenSUSE Linux update for libcroco
• Resource management error in libcroco (Alpine package)
• Ubuntu update for libcroco
• VMware Tanzu products update for Libcroco
• Ubuntu update for libcroco