CVE-2017-11554 There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4.5. A crafted input will lead to a remote denial of service.
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4.5. A crafted input will lead to a remote denial of service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libsass(Debian:12) | < 3.5.4-1 | 3.5.4-1 |
| debian/libsass(Debian:13) | < 3.5.4-1 | 3.5.4-1 |
| debian/libsass(Debian:14) | < 3.5.4-1 | 3.5.4-1 |
| libsass | = 3.4.5 | No fix listed |
References
- Debian Security Tracker CVE-2017-11554 vendor-advisory
- bugzilla.redhat.com exploit issue-tracking third-party-advisory
- github.com third-party-advisory
- bugs.debian.org issue-tracking