CVE-2017-7960 The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.
MediumCVSS 5.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME libcroco | = 0.6.11 | No fix listed |
| GNOME libcroco | = 0.6.12 | No fix listed |
| alpine/libcroco(Alpine:v3.10) | < 0.6.13-r1 | 0.6.13-r1 |
| alpine/libcroco(Alpine:v3.11) | < 0.6.13-r1 | 0.6.13-r1 |
| alpine/libcroco(Alpine:v3.7) | < 0.6.12-r1 | 0.6.12-r1 |
| alpine/libcroco(Alpine:v3.8) | < 0.6.12-r2 | 0.6.12-r2 |
| alpine/libcroco(Alpine:v3.9) | < 0.6.12-r2 | 0.6.12-r2 |
References
- openSUSE-SU-2019:1575 vendor-advisory
- blogs.gentoo.org exploit patch third-party-advisory
- git.gnome.org patch third-party-advisory
- GLSA-201707-13 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory