In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in     SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash)     via a crafted sass input file. (CVE-2018-19797)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4837-1 advisory.

    It was discovered that LibSass incorrectly handled certain specially crafted sass file. An attacker could     possibly use this issue to cause a denial of service or other unspecified impact.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libsass to version 3.6.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-6283: Fixed heap-buffer-overflow in     Sass::Prelexer::parenthese_scope(char const*)     (boo#1121943).

  - CVE-2019-6284: Fixed heap-based buffer over-read exists     in Sass:Prelexer:alternatives (boo#1121944).

  - CVE-2019-6286: Fixed heap-based buffer over-read exists     in Sass:Prelexer:skip_over_scopes (boo#1121945).

  - CVE-2018-11499: Fixed use-after-free vulnerability in     sass_context.cpp:handle_error (boo#1096894).

  - CVE-2018-19797: Disallowed parent selector in     selector_fns arguments (boo#1118301).

  - CVE-2018-19827: Fixed use-after-free vulnerability     exists in the SharedPtr class (boo#1118346).

  - CVE-2018-19837: Fixed stack overflow in Eval::operator()     (boo#1118348).

  - CVE-2018-19838: Fixed stack-overflow at     IMPLEMENT_AST_OPERATORS expansion (boo#1118349).

  - CVE-2018-19839: Fixed buffer-overflow (OOB read) against     some invalid input (boo#1118351).

  - CVE-2018-20190: Fixed NULL pointer dereference in     Sass::Eval::operator()(Sass::Supports_Operator*)     (boo#1119789).

  - CVE-2018-20821: Fixed uncontrolled recursion in     Sass:Parser:parse_css_variable_value (boo#1133200).

  - CVE-2018-20822: Fixed stack-overflow at     Sass::Inspect::operator() (boo#1133201).

ID	Name	Product	Family	Severity
255383	Linux Distros Unpatched Vulnerability : CVE-2018-19797	Nessus	Misc.	medium
183625	Ubuntu 18.04 ESM : LibSass vulnerabilities (USN-4837-1)	Nessus	Ubuntu Local Security Checks	critical
126975	openSUSE Security Update : libsass (openSUSE-2019-1791)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2018-19797

medium

Tenable Plugins

medium

critical

critical