744 matches found
CVE-2016-10595
jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...
LibSass Memory Misreference Vulnerability
LibSass is an open source written in C using Sass CSS extension language parser . A memory misreference vulnerability exists in the 'handleerror' function in the sasscontext.cpp file in LibSass versions 3.4.x and 3.5.x through 3.5.4. An attacker could exploit this vulnerability to cause a denial ...
UBUNTU-CVE-2018-11499
A use-after-free vulnerability exists in handleerror in sasscontext.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service application crash or possibly unspecified other impact...
The vulnerability of the Sass::Eval::operator function (eval.cpp) in the LibSass library allows a hacker to cause a denial-of-service attack.
The vulnerability of the Sass::Eval::operator eval.cpp function in the LibSass library is caused by the consumption of memory resources on the stack. Exploiting this vulnerability may allow a malicious actor to cause a service failure...
LibSass Denial of Service Vulnerability
LibSass is an open source written in C using Sass CSS extension language parser . A denial of service vulnerability exists in the 'Sass::Eval::operator' function in the eval.cpp file in LibSass version 3.4.5. A remote attacker can exploit this vulnerability to cause a denial of service stack...
LibSass Denial of Service Vulnerability (CNVD-2017-27708)
LibSass is an open source written in C using Sass CSS extension language parser . A denial of service vulnerability exists in the 'Sass::Eval::operator' function in the eval.cpp file in LibSass version 3.4.5. A remote attacker can exploit this vulnerability to cause a denial of service...
UBUNTU-CVE-2017-12963
There is an illegal address access in Sass::Eval::operator in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but remains exploitable after the vendor's CVE-2017-11555 fix available from GitHub after 2017-07-24...
CVE-2017-12963
There is an illegal address access in Sass::Eval::operator in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but remains exploitable after the vendor's CVE-2017-11555 fix available from GitHub after 2017-07-24...
CVE-2017-11608
There is a heap-based buffer over-read in the Sass::Prelexer::relinebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack...
Resources Downloaded Through Insecure Protocol
gfe-sass downloads resources through an insecure protocol. The library downloads resources through HTTP, allowing a man-in-the-middle attack to tamper with the content in transit...
UBUNTU-CVE-2017-10687
In LibSass 3.4.5, there is a heap-based buffer over-read in the function jsonmkstream in sasscontext.cpp. A crafted input will lead to a remote denial of service attack...
LibSass: stack overflow #6 in libsass
Feeding //0i: to ./sassc -s triggers this stack overflow. ==11380==ERROR: AddressSanitizer: stack-overflow on address 0x7fff1665bfa8 pc 0x000000584802 bp 0x7fff1665c810 sp 0x7fff1665bfb0 T0 0 0x584801 in asanmemcpy /home/geeknik/sassc/bin/sassc+0x584801 1 0x87a353 in char const...
LibSass: heap-use-after-free in Sass::SharedPtr::incRefCount()
Feeding @Pif0,0::SharedImplSass::Expression /home/geeknik/libsass/src/memory/SharedPtr.hpp:141:23 3 0x9820a2 in Sass::Eval::operatorSass::FunctionCall /home/geeknik/libsass/src/eval.cpp:1018 4 0x951b36 in Sass::Eval::operatorSass::List /home/geeknik/libsass/src/eval.cpp:502:18 5 0x9a0042 in...
LibSass: heap-buffer-overflow (read outside of buffer) in Sass::Prelexer::exactly<(char)92>(char const*) - libsass/src/lexer.hpp:92
Built with afl-clang-fast from git source 5909ba5. Feeding a file that contains nothing but '\ to sassc triggers this flaw. ==22006==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ef93 at pc 0x000000907c6a bp 0x7fff656d9430 sp 0x7fff656d9428 READ of size 1 at 0x60200000ef93...
Downloads Resources over HTTP
Overview Affected versions of gfe-sass insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...
Downloads Resources over HTTP
Overview Affected versions of fis-parser-sass-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...
Downloads Resources over HTTP
Overview Affected versions of jdf-sass insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...
[SECURITY] Fedora 23 Update: drupal7-theme-zen-5.6-1.fc23
Zen is a powerful, yet simple, HTML5 starting theme with a responsive, mobile-first grid design. If you are building your own standards-compliant theme, you will find it much easier to start with Zen than to start with Garland or Stark. This theme has fantastic online documentation...
[SECURITY] Fedora 24 Update: drupal7-theme-zen-5.6-1.fc24
Zen is a powerful, yet simple, HTML5 starting theme with a responsive, mobile-first grid design. If you are building your own standards-compliant theme, you will find it much easier to start with Zen than to start with Garland or Stark. This theme has fantastic online documentation...
