Denial of Service Vulnerability in libcroco: Heap-based Buffer Over-read
Summary
ALPINE-CVE-2017-7960: The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file. Affects libcroco versions < 0.6.13-r1. Fixed in 0.6.13-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcroco is a library for parsing and manipulating CSS (Cascading Style Sheets). It is widely used in various applications to handle CSS files efficiently. The library provides functionalities to read, write, and manipulate CSS data structures. However, certain versions of libcroco are vulnerable to a denial of service attack due to improper handling of crafted CSS files, which can lead to heap-based buffer over-reads.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7960, exists in the cr_input_new_from_uri function within cr-input.c of libcroco versions 0.6.11 and 0.6.12. Remote attackers can exploit this vulnerability by sending a specially crafted CSS file, causing a denial of service through a heap-based buffer over-read. This can lead to application crashes or unexpected behavior, impacting the availability of services that rely on libcroco for CSS processing.
How To Fix
Minimum fixed version
0.6.13-r1
This is the first release that contains the fix.
sudo apk add --upgrade libcrocoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to reject any CSS files that do not conform to expected formats, thereby mitigating the risk of exploitation.
Conclusion
The CVE-2017-7960 vulnerability in libcroco poses a significant risk of denial of service due to improper handling of crafted CSS files. It is crucial for users of affected versions to update to the patched versions to mitigate this risk. Regular monitoring and validation of dependencies can help prevent such vulnerabilities.
See every vulnerability recorded for libcroco →
FAQ
CVE-2017-7960 is a vulnerability in libcroco that allows remote attackers to cause a denial of service through a heap-based buffer over-read by sending a crafted CSS file.
The affected versions of libcroco are 0.6.11 and 0.6.12. Versions 0.6.13-r1 and later are patched.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
Exploitation of this vulnerability can lead to application crashes and denial of service, affecting the availability of services that utilize libcroco.
Yes, the CVSS score for CVE-2017-7960 is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcroco.
