Description

There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1474276

Related Vulnerabilities

CVE-2019-15607 Vulnerability in npm package node-red

CVE-2022-24615 Vulnerability in maven package net.lingala.zip4j:zip4j

CVE-2023-46122 Vulnerability in maven package org.scala-sbt:io_3

CVE-2021-3794 Vulnerability in npm package @vuelidate/validators

CVE-2017-17837 Vulnerability in maven package org.apache.deltaspike.modules:deltaspike-jsf-module-impl

Severity

High

Classification

CWE-125 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Tags

Issue Tracking