PT-2017-18028 · Gnome+2 · Libcroco+2

Mikhail Kasimov · Published 2017-04-19 · Updated 2024-08-05 · CVE-2017-7961

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libcroco versions 0.6.11 through 0.6.12

Description The issue is related to an "outside the range of representable values of type long" undefined behavior in the cr tknzr parse rgb function, which could potentially allow remote attackers to cause a denial of service or have unspecified other impact via a crafted CSS file. However, third-party analysis suggests that this might not be a security issue due to the nature of the conversion and its impact.

Recommendations For libcroco versions 0.6.11 and 0.6.12, consider applying a patch or fix that addresses the undefined behavior in the cr tknzr parse rgb function to prevent potential denial of service or other impacts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2019-1596

CVE-2017-7961

DLA-909-1

MGASA-2019-0389

OPENSUSE-SU-2019_1575-1

OPENSUSE-SU-2024:10932-1

SUSE-SU-2019:1468-1

SUSE-SU-2019_1468-1

Affected Products

Alt Linux

Suse

Libcroco

References · 26

• 🔥 https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7961 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0389 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00043.html · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1034482 · Patch
• https://advisories.mageia.org/MGASA-2019-0389.html · Security Note
• https://osv.dev/vulnerability/CVE-2017-7961 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/04/24/2 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2019:1468-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201707-13 · Vendor Advisory
• https://git.gnome.org/browse/libcroco/commit/?id=9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2017-7961 · Vendor Advisory
• https://suse.com/support/update/announcement/2019/suse-su-20191468-1 · Note
• https://suse.com/security/cve/CVE-2017-8871 · Note
• https://suse.com/security/cve/CVE-2017-8834 · Note