CVE-2017-7960

Опубликовано: 19 апр. 2017

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00043.html
https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior/
Exploit
Patch
Third Party Advisory
https://git.gnome.org/browse/libcroco/commit/?id=898e3a8c8c0314d2e6b106809a8e3e93cf9d4394
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201707-13
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00043.html
https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior/
Exploit
Patch
Third Party Advisory
https://git.gnome.org/browse/libcroco/commit/?id=898e3a8c8c0314d2e6b106809a8e3e93cf9d4394
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201707-13
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gnome:libcroco:0.6.11:*:*:*:*:*:*:*

cpe:2.3:a:gnome:libcroco:0.6.12:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00533

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2017-7960

CVSS3: 5.5

ubuntu

почти 9 лет назад

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.

CVE-2017-7960

CVSS3: 3.3

redhat

почти 9 лет назад

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.

CVE-2017-7960

CVSS3: 5.5

debian

почти 9 лет назад

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 an ...

GHSA-wmq5-69f7-qrqx

CVSS3: 5.5

github

больше 3 лет назад

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.

openSUSE-SU-2019:1575-1

suse-cvrf

больше 6 лет назад

Security update for libcroco

EPSS

Процентиль: 67%

0.00533

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-125