Heap-based Buffer Over-read and Undefined Behavior in libcroco
Summary
DLA-909-1: libcroco - security update. Affects libcroco versions < 0.6.6-2+deb7u1. Fixed in 0.6.6-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcroco is a library for parsing and manipulating CSS (Cascading Style Sheets) files. It provides functionality for reading, writing, and modifying CSS files. The library is widely used in various applications that deal with CSS files, such as web browsers and text editors. However, libcroco is vulnerable to two security issues that could be exploited remotely.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-7960, is a heap-based buffer over-read issue. An attacker can trigger this vulnerability by providing a specially crafted CSS file, leading to a denial of service. The second vulnerability, CVE-2017-7961, involves an undefined behavior issue related to a long type. By supplying a malicious CSS file, an attacker may cause a denial of service or potentially achieve other unspecified impacts.
How To Fix
Minimum fixed version
0.6.6-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcrocoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the provided fix by upgrading the libcroco package.
Conclusion
libcroco is susceptible to a heap-based buffer over-read vulnerability (CVE-2017-7960) and an undefined behavior issue (CVE-2017-7961). These vulnerabilities can be mitigated by updating the libcroco package to version 0.6.6-2+deb7u1 or later. It is crucial to apply the fix promptly to ensure the security of systems using libcroco. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libcroco →
FAQ
libcroco is a library used for parsing and manipulating CSS files.
CVE-2017-7960 is a heap-based buffer over-read vulnerability in libcroco that can be triggered remotely via a crafted CSS file.
CVE-2017-7961 is an undefined behavior issue in libcroco related to a long type, which can be exploited through a malicious CSS file.
The vulnerabilities could lead to a denial of service (application crash) or other unspecified impacts.
To fix these vulnerabilities, you need to upgrade the libcroco package to version 0.6.6-2+deb7u1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for libcroco.
