PatchTheCVElibsass vulnerabilities
Recent CVEs affecting libsass products. 11 tracked.
libsass has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2017-08-18. Highest priority: CVE-2017-11554 (score 56/100).
- CVE-2017-12964 HIGH 7.5 DOWNGRADE There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() i
- CVE-2017-12963 HIGH 7.5 DOWNGRADE There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote
- CVE-2017-12962 HIGH 7.5 DOWNGRADE There are memory leaks in LibSass 3.4.5 triggered by deeply nested code, such as code with a long sequence of
- CVE-2017-11608 MEDIUM 6.5 DOWNGRADE There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.
- CVE-2017-11605 MEDIUM 6.5 DOWNGRADE There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1
- CVE-2017-11556 HIGH 7.5 DOWNGRADE There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass
- CVE-2017-11555 HIGH 7.5 DOWNGRADE There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5
- CVE-2017-11554 HIGH 7.5 DOWNGRADE There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4
- CVE-2017-11342 HIGH 7.5 DOWNGRADE There is an illegal address access in ast.cpp of LibSass 3.4.5
- CVE-2017-11341 HIGH 7.5 DOWNGRADE There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5
- CVE-2017-10687 HIGH 7.5 DOWNGRADE In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp
FAQ
How do I fix libsass vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libsass being exploited right now?
None of the tracked libsass CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libsass CVE should I patch first?
CVE-2017-11554 currently ranks highest (56/100): There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4.