Lucene search

MitreCVE-2017-7961

HistoryApr 19, 2017 - 3:59 p.m.

CVE-2017-7961

2017-04-1915:59:00

CWE-119

mitre

web.nvd.nist.gov

141

cve

2017

7961

cr_tknzr_parse_rgb

libcroco

undefined behavior

denial of service

application crash

css file

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.007

Percentile

80.3%

JSON

The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an “outside the range of representable values of type long” undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.

Affected configurations

Nvd

Node

gnomelibcrocoMatch0.6.11

gnomelibcrocoMatch0.6.12

VendorProductVersionCPE
gnomelibcroco0.6.11cpe:2.3:a:gnome:libcroco:0.6.11:*:*:*:*:*:*:*
gnomelibcroco0.6.12cpe:2.3:a:gnome:libcroco:0.6.12:*:*:*:*:*:*:*