Product:

Libsass

(Sass\-Lang)
Repositories https://github.com/sass/libsass
#Vulnerabilities 27
Date Id Summary Products Score Patch Annotated
2023-08-22 CVE-2022-26592 Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. Libsass 8.8
2023-08-22 CVE-2022-43357 Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2. Libsass, Sassc 7.5
2023-08-22 CVE-2022-43358 Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS). Libsass 7.5
2018-12-03 CVE-2018-19826 In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design Libsass 6.5
2019-01-14 CVE-2019-6283 In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp. Libsass 6.5
2019-01-14 CVE-2019-6284 In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp. Libsass 6.5
2019-04-23 CVE-2018-20821 The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp). Libsass 6.5