sass-lang libsass 3.5.5 vulnerabilities and exploits

(subscribe to this query)

383

VMScore

In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE:...

Sass-lang Libsass 3.5.5

383

VMScore

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

Sass-lang Libsass 3.5.5

605

VMScore

In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.

Sass-lang Libsass 3.5.5

383

VMScore

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.

Sass-lang Libsass 3.5.5

383

VMScore

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.

Sass-lang Libsass 3.5.5

383

VMScore

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.

Sass-lang Libsass 3.5.5

383

VMScore

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.

Sass-lang Libsass 3.5.5

384

VMScore

The parsing component in LibSass up to and including 3.5.5 allows malicious users to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).

Sass-lang Libsass

383

VMScore

In LibSass before 3.5.5, the function handle_error in sass_context.cpp allows malicious users to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.

Sass-lang Libsass

383

VMScore

In LibSass before 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow malicious users to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().

Sass-lang Libsass

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook