Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:1468-1

Опубликовано: 12 июн. 2019
Источник: suse-cvrf

Описание

Security update for libcroco

This update for libcroco fixes the following issues:

Security issues fixed:

  • CVE-2017-7960: Fixed heap overflow (input: check end of input before reading a byte) (bsc#1034481).
  • CVE-2017-7961: Fixed undefined behavior (tknzr: support only max long rgb values) (bsc#1034482).
  • CVE-2017-8834: Fixed denial of service (memory allocation error) via a crafted CSS file (bsc#1043898).
  • CVE-2017-8871: Fixed denial of service (infinite loop and CPU consumption) via a crafted CSS file (bsc#1043899).

Список пакетов

Image SLES12-SP4-Azure-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-EC2-HVM-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-GCE-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-OCI-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-Azure
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-Azure-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-Azure-LI-BYOS-Production
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-EC2-HVM
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-EC2-HVM-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-GCE
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-GCE-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-SAP-OCI-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-Azure-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-Azure-Basic-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-Azure-HPC-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-Azure-HPC-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-Azure-SAP-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-Azure-SAP-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-Azure-Standard-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-EC2-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-EC2-ECS-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-EC2-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-EC2-SAP-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-EC2-SAP-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-GCE-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-GCE-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-GCE-SAP-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-GCE-SAP-On-Demand
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-OCI-BYOS-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-OCI-BYOS-SAP-BYOS
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
libcroco-0_6-3-0.6.11-12.3.1
SUSE Linux Enterprise Desktop 12 SP3
libcroco-0_6-3-0.6.11-12.3.1
libcroco-0_6-3-32bit-0.6.11-12.3.1
SUSE Linux Enterprise Desktop 12 SP4
libcroco-0_6-3-0.6.11-12.3.1
libcroco-0_6-3-32bit-0.6.11-12.3.1
SUSE Linux Enterprise Server 12 SP3
libcroco-0_6-3-0.6.11-12.3.1
libcroco-0_6-3-32bit-0.6.11-12.3.1
SUSE Linux Enterprise Server 12 SP4
libcroco-0_6-3-0.6.11-12.3.1
libcroco-0_6-3-32bit-0.6.11-12.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libcroco-0_6-3-0.6.11-12.3.1
libcroco-0_6-3-32bit-0.6.11-12.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
libcroco-0_6-3-0.6.11-12.3.1
libcroco-0_6-3-32bit-0.6.11-12.3.1
SUSE Linux Enterprise Software Development Kit 12 SP3
libcroco-0.6.11-12.3.1
libcroco-devel-0.6.11-12.3.1
SUSE Linux Enterprise Software Development Kit 12 SP4
libcroco-0.6.11-12.3.1
libcroco-devel-0.6.11-12.3.1

Ссылки

Описание

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.

Затронутые продукты
Image SLES12-SP4-Azure-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-EC2-HVM-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-GCE-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-OCI-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Ссылки

Описание

** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components."

Затронутые продукты
Image SLES12-SP4-Azure-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-EC2-HVM-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-GCE-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-OCI-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Ссылки

Описание

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Затронутые продукты
Image SLES12-SP4-Azure-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-EC2-HVM-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-GCE-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-OCI-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Ссылки

Описание

The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.

Затронутые продукты
Image SLES12-SP4-Azure-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-EC2-HVM-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-GCE-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Image SLES12-SP4-OCI-BYOS:libcroco-0_6-3-0.6.11-12.3.1
Ссылки