Product:

Libsass

(Sass\-Lang)
Repositories https://github.com/sass/libsass
#Vulnerabilities 27
Date Id Summary Products Score Patch Annotated
2018-12-03 CVE-2018-19826 In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design Libsass 6.5
2023-08-22 CVE-2022-43357 Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2. Libsass, Sassc 7.5
2023-08-22 CVE-2022-43358 Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS). Libsass 7.5
2023-08-22 CVE-2022-26592 Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. Libsass 8.8
2019-01-14 CVE-2019-6283 In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp. Libsass 6.5
2019-01-14 CVE-2019-6284 In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp. Libsass 6.5
2019-04-23 CVE-2018-20821 The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp). Libsass 6.5
2019-04-23 CVE-2018-20822 LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp). Libsass 6.5
2018-11-12 CVE-2018-19219 In LibSass 3.5-stable, there is an illegal address access at Sass::Eval::operator that will lead to a DoS attack. Libsass 6.5
2019-11-06 CVE-2019-18799 LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp. Libsass N/A