libsass: CVE-2017-11554 CVE-2017-11555 CVE-2017-11556

Debian Bug report logs - #870182
libsass: CVE-2017-11554 CVE-2017-11555 CVE-2017-11556

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libsass: CVE-2017-11554 CVE-2017-11555 CVE-2017-11556

Date: Sun, 30 Jul 2017 21:46:13 +0200

Source: libsass
Version: 3.4.3-1
Severity: important
Tags: upstream security

Hi,

the following vulnerabilities were published for libsass.

CVE-2017-11554[0]:
| There is a stack consumption vulnerability in the lex function in
| parser.hpp (as used in sassc) in LibSass 3.4.5. A crafted input will
| lead to a remote denial of service.

CVE-2017-11555[1]:
| There is an illegal address access in the Eval::operator function in
| eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial
| of service.

CVE-2017-11556[2]:
| There is a stack consumption vulnerability in the
| Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A
| crafted input may lead to remote denial of service.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11554
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11554
[1] https://security-tracker.debian.org/tracker/CVE-2017-11555
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11555
[2] https://security-tracker.debian.org/tracker/CVE-2017-11556
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11556

All of those were reported upstream, and tested on Red Hat as well for
older version like 3.4.1.

Regards,
Salvatore

Send a report that this bug log contains spam.