CVE-2017-12962 CVE-2017-12963 CVE-2017-12964

Debian Bug report logs - #873034
CVE-2017-12962 CVE-2017-12963 CVE-2017-12964

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2017-12962 CVE-2017-12963 CVE-2017-12964

Date: Wed, 23 Aug 2017 22:51:57 +0200

Source: libsass
Severity: important
Tags: security

Please see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12962
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12963
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12964

Cheers,
        Moritz

Message #10 received at 873034-done@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <jonas@jones.dk>

To: 873034-done@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: [Pkg-sass-devel] Bug#873034: CVE-2017-12962 CVE-2017-12963 CVE-2017-12964

Date: Mon, 11 Mar 2019 13:33:53 +0100

[Message part 1 (text/plain, inline)]

control: tags -1 unreproducible

Quoting Moritz Muehlenhoff (2017-08-23 22:51:57)
> Please see:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12962
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12963
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12964

None of above seems to affects Debian released versions of libsass.


CVE-2017-12962 hints that (at least) version 3.4.5 is affected.

https://bugzilla.redhat.com/show_bug.cgi?id=1482331 indicates that the 
bug should be reproducible on Debian systems using these commands:

apt install sassc wget ca-certificates unrar
wget https://bugzilla.redhat.com/attachment.cgi?id=1314521
unrar x attachment.cgi?id=1314521
sassc POC7

On a stretch+non-free chroot with libsass1 3.4.3-1 and sassc 3.4.2-1, 
last command above results in this non-segfault error:

Internal Error: Invalid UTF-8

On a buster+non-free chroot with libsass1 3.5.5-2 and sassc 3.5.0-1, 
last command above results in this non-segfault error:

Internal Error: Invalid UTF-8



CVE-2017-12963 hints that (at least) version 3.4.5 is affected.

https://bugzilla.redhat.com/show_bug.cgi?id=1482335 indicates that the 
bug should be reproducible on Debian systems using these commands:

apt install sassc wget ca-certificates
wget https://bugzilla.redhat.com/attachment.cgi?id=1314525
sassc attachment.cgi\?id\=1314525

On a stretch chroot with libsass1 3.4.3-1 and sassc 3.4.2-1, last 
command above results in this non-segfault error:

Error: Undefined operation: "746666666666646691131686912 mod %".
        on line 1 of /attachment.cgi?id=1314525
>> $I:K66666466+KKKOKO6=746666666666646666666666466%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   -------------^

On a buster chroot with libsass1 3.5.5-2 and sassc 3.5.0-1, last command 
above results in this non-segfault error:

Error: Invalid UTF-8 sequence
        on line 1 of /attachment.cgi?id=1314525
>> 666666666466+KKKOKO=7+66+KKKOKO=7+666666QK�6666466+K666666QK�6666466+KKKOKO6
   ------------------------------------------^



CVE-2017-12964 hints that (at least) version 3.4.5 is affected.

https://bugzilla.redhat.com/show_bug.cgi?id=1482397 indicates that the 
bug should be reproducible on Debian systems using these commands:

apt install sassc wget ca-certificates unrar
wget https://bugzilla.redhat.com/attachment.cgi?id=1314586
unrar x attachment.cgi\?id\=1314586
sassc POC9

On a stretch+non-free chroot with libsass1 3.4.3-1 and sassc 3.4.2-1, 
last command above results in this non-segfault error:

Error: Undefined operation: "746666666666646691131686912 mod %".
        on line 1 of POC9
>> $I:K66666466+KKKOKO6=746666666666646666666666466%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   -------------^

On a buster+non-free chroot with libsass1 3.5.5-2 and sassc 3.5.0-1, 
last command above results in this non-segfault error:

Error: Invalid UTF-8 sequence
        on line 1 of /POC9
>> 666666666466+KKKOKO=7+66+KKKOKO=7+666666QK�6666466+K666666QK�6666466+KKKOKO6
   ------------------------------------------^


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.