Description

There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will lead to a remote denial of service attack.

Remediation

References

http://www.securityfocus.com/bid/99930

https://bugzilla.redhat.com/show_bug.cgi?id=1474019

Related Vulnerabilities

CVE-2017-7957 Vulnerability in maven package xstream:xstream

CVE-2020-15174 Vulnerability in maven package org.webjars.npm:electron

CVE-2019-10777 Vulnerability in npm package aws-lambda

CVE-2019-10341 Vulnerability in maven package io.jenkins.docker:docker-plugin

CVE-2016-10686 Vulnerability in npm package fis-sass-all

Severity

High

Classification

CWE-125 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Tags

Third Party Advisory VDB Entry Issue Tracking