Denial of Service Vulnerability in libcroco: CVE-2017-8871
Summary
ALPINE-CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file. Affects libcroco versions < 0.6.13-r1. Fixed in 0.6.13-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libcroco is a library for parsing and manipulating CSS (Cascading Style Sheets). It is commonly used in applications that require CSS support for styling web content. The library is designed to handle various CSS specifications and provides functionalities for CSS parsing, selector matching, and property manipulation. However, a vulnerability has been identified in libcroco versions prior to 0.6.13-r1, which can lead to denial of service attacks.
Vulnerability Detail
The cr_parser_parse_selector_core function in cr-parser.c of libcroco version 0.6.12 contains a flaw that allows remote attackers to exploit crafted CSS files. This can result in an infinite loop, causing excessive CPU consumption and potentially crashing the application. The vulnerability is classified under CVE-2017-8871, with a CVSS score of 6.5, indicating a moderate severity level. Attackers can leverage this vulnerability to disrupt service availability, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
0.6.13-r1
This is the first release that contains the fix.
sudo apk add --upgrade libcrocoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted or user-supplied CSS files until the package is updated. Implementing strict validation on CSS input can also help mitigate the risk of exploitation.
Conclusion
The CVE-2017-8871 vulnerability in libcroco poses a significant risk of denial of service through crafted CSS files. It is crucial for users to update to the patched version to protect their applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libcroco →
FAQ
CVE-2017-8871 is a vulnerability in the libcroco library that allows remote attackers to cause denial of service through crafted CSS files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to an infinite loop and high CPU usage, resulting in service disruption and denial of service.
Yes, the patched version of libcroco is 0.6.13-r1 for Alpine Linux users. Updating to this version will fix the vulnerability.
If immediate updates are not possible, avoid processing untrusted CSS files and implement input validation to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcroco.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
