CVE-2018-20821

CVE-2018-20821 : LibSass up to version 3.5.5 is vulnerable to a denial of service due to uncontrolled recursion in Sass::Parser::parse_css_variable_value (parser.cpp). The root cause is in the parsing component; attackers could trigger DoS by crafting input. The connected documents confirm the af...

CVE-2018-19827

CVE-2018-19827 : In LibSass 3.5.5, there is a use-after-free vulnerability in the SharedPtr implementation (SharedPtr.cpp/SharedPtr.hpp). This flaw may cause a denial of service via application crash and could have unspecified other impact. The description confirms the affected component and vers...

CVE-2018-19797

CVE-2018-19797 : LibSass 3.5.5 contains a NULL pointer dereference in Sass::Selector_List::populate_extends (SharedPtr.hpp, used by ast.cpp/ast_selectors.cpp) that can cause a Denial of Service (application crash) when processing crafted Sass input. The provided connected documents confirm the vu...

CVE-2019-6286

Technical details (affected products/versions, root cause, exploit info, and fixes) for CVE-2019-6286 are not provided in the connected documents. The Initial Description notes a heap-based buffer over-read in LibSass 3.5.5 but contains no further specifics.

CVE-2019-6283

CVE-2019-6283: LibSass 3.5.5 contains a heap-based buffer over-read in Sass::Prelexer::parenthese_scope (prelexer.hpp). The initial description specifies this specific over-read, but no exploitation details or fixes are provided in the supplied documents.

CVE-2018-19839

CVE-2018-19839 affects LibSass prior to 3.5.5. The vulnerability is a heap-based buffer over-read in Sass::handle_error (sass_context.cpp) that attackers can trigger via a crafted Sass file, causing a denial-of-service. Public details in the initial document confirm the exact function and file, t...

CVE-2018-20822

CVE-2018-20822 relates to LibSass 3.5.4, where a vulnerability allows a denial-of-service via uncontrolled recursion in Sass::Complex_Selector::perform (ast.hpp) and Sass::Inspect::operator (inspect.cpp). The CVE description in the initial document confirms the DoS impact. Connected documents sho...

CVE-2018-19838

CVE-2018-19838 concerns LibSass pre-3.5.5, where functions in ast.cpp used for IMPLEMENT_AST_OPERATORS expansion can cause a denial of service via stack consumption when processing a crafted Sass file. The vulnerability arises from a stack-based buffer/recursion pattern in the IMPLEMENT_AST_OPERA...

CVE-2019-6284

CVE-2019-6284 : LibSass 3.5.5 has a heap-based buffer over-read in Sass::Prelexer::alternatives (prelexer.hpp). This is the root cause of a memory safety issue that can lead to a crash or memory corruption. Documented impact is a denial of service through crash/over-read; exploitation details or ...

CVE-2018-11499

CVE-2018-11499 is a use-after-free in LibSass (sass_context.cpp, handle_error()) affecting LibSass 3.4.x and 3.5.x up to 3.5.4. It could crash the application (DoS) and potentially other impacts. Affected entries in connected docs point to LibSass vulnerabilities and advise upgrading to the lates...

CVE-2018-19837

CVE-2018-19837 affects LibSass prior to 3.5.5, where Sass::Eval::operator() in eval.cpp can trigger a denial-of-service via stack consumption from parsing '%' as modulo in parser.cpp. Affected versions include.LibSass vulnerability details are corroborated by multiple advisories (e.g., openSUSE/l...

CVE-2018-20190

CVE-2018-20190 affects LibSass 3.5.5; root cause is a NULL pointer dereference in Sass::Eval::operator() (eval.cpp) that can cause a Denial of Service (crash) with a crafted Sass input. Public details about a patch/fix are not provided in the connected documents; monitor for updated fixes.

CVE-2019-18798

LibSass before 3.6.3 contains a heap-based buffer over-read in Sass::weaveParents (ast_sel_weave.cpp). Public docs provided here confirm the affected component and the exact function, but do not include exploit details, affected versions beyond “before 3.6.3,” or remediation steps. No additional ...

CVE-2019-18799

CVE-2019-18799 concerns LibSass before 3.6.3, which allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector (parser_selectors.cpp). The description consistently states this is a NULL pointer dereference vulnerability that could be exploited to crash the application. Affected prod...

CVE-2018-11697

CVE-2018-11697 affects LibSass up to version 3.5.4, with an out-of-bounds read in Sass::Prelexer::exactly() that could disclose information or be leveraged to read unmapped memory, causing a denial of service. Public details in connected docs confirm the vulnerability class and impact, including ...

CVE-2018-11696

The CVE concerns the library LibSass up to version 3.5.4, with a NULL pointer dereference in the function Sass::Inspect::operator that can be exploited to cause a denial of service (crash) or other unspecified impact. Affected context is the Sass processing path; no explicit exploit or victim spe...

CVE-2019-18797

CVE-2019-18797 affects LibSass 3.6.1 and is caused by uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp. The vulnerability can lead to a crash via crafted Sass input, consistent with denials of service behavior reported in multiple sources. Remediation: upgrad...

CVE-2018-11694

CVE-2018-11694 affects LibSass up to version 3.5.4. The vulnerability is a NULL pointer dereference in Sass::Functions::selector_append, which can be leveraged to cause a denial of service (application crash) and potentially other impacts. Exploitation details or in‑the‑wild usage are not explici...

CVE-2018-11698

CVE-2018-11698 affects LibSass up to 3.5.4. The issue is an out-of-bounds read in Sass::handle_error, which could disclose information or be manipulated to read unmapped memory, causing a denial of service. The Nessus entry notes this vulnerability as unpatched with no vendor patch available at t...

CVE-2018-11693

CVE-2018-11693 affects LibSass

CVE-2022-43358

Summary (CVE-2022-43358): The vulnerability affects libsass (example: libsass 3.6.5-8-g210218) with a stack overflow in ast_selectors.cpp (Sass::ComplexSelector::has_placeholder) that can lead to denial of service. Several connected advisories/applications reference this issue alongside related C...

CVE-2022-43357

CVE-2022-43357 is a stack overflow vulnerability in libsass:3.6.5-8-g210218 (Sass::CompoundSelector::has_real_parent_ref) that can lead to denial of service. The issue also affects the sassc 3.6.2 CLI. Multiple Nessus/debian/openSUSE/SUSE/SUSE-derived advisories confirm the same flaw. Remediation...

CVE-2022-26592

CVE-2022-26592 affects libsass 3.6.5, with a Stack Overflow vulnerability in CompoundSelector::has_real_parent_ref that can lead to DoS or crash. Multiple connected advisories confirm libsass-related impacts and advise upgrading to a newer package version (e.g., libsass 3.6.6-1 or newer, dependin...

CVE-2018-19218

CVE-2018-19218 affects LibSass 3.5-stable. The vulnerability is an illegal address access in Sass::Parser::parse_css_variable_value_token, causing a denial of service. The connected documents confirm the component and root cause but do not provide a concrete patch/version for remediation. Exploit...

CVE-2018-11695

CVE-2018-11695 affects LibSass

CVE-2018-19826

Summary: CVE-2018-19826 affects LibSass 3.5.5. A DoS can occur due to an infinite loop in Sass::Inspect::operator()(Sass::String_Quoted*) triggered by crafted Sass input containing stray '&' or '/' characters, leading to a high memory footprint. The upstream advisory notes the issue is closed as ...

CVE-2018-19219

CVE-2018-19219 affects LibSass 3.5-stable, where an illegal address access in the function Sass::Eval::operator can lead to a denial of service. The Connected documents consistently describe the same issue, with no public details on vulnerable configurations beyond LibSass 3.5-stable. Relevant im...