Description

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

Remediation

References

https://github.com/sass/libsass/issues/2779

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html

Related Vulnerabilities

CVE-2022-21653 Vulnerability in maven package org.typelevel:jawn-parser_3

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth

CVE-2022-33891 Vulnerability in maven package org.apache.spark:spark-core_2.13

CVE-2022-45135 Vulnerability in maven package org.apache.cocoon:cocoon-databases-impl

CVE-2021-40143 Vulnerability in maven package org.sonatype.nexus:nexus-repository

Severity

High

Classification

CWE-476 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Tags

Patch Third Party Advisory