In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4837-1 advisory.

    It was discovered that LibSass incorrectly handled certain specially crafted sass file. An attacker could     possibly use this issue to cause a denial of service or other unspecified impact.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libsass to version 3.6.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-6283: Fixed heap-buffer-overflow in     Sass::Prelexer::parenthese_scope(char const*)     (boo#1121943).

  - CVE-2019-6284: Fixed heap-based buffer over-read exists     in Sass:Prelexer:alternatives (boo#1121944).

  - CVE-2019-6286: Fixed heap-based buffer over-read exists     in Sass:Prelexer:skip_over_scopes (boo#1121945).

  - CVE-2018-11499: Fixed use-after-free vulnerability in     sass_context.cpp:handle_error (boo#1096894).

  - CVE-2018-19797: Disallowed parent selector in     selector_fns arguments (boo#1118301).

  - CVE-2018-19827: Fixed use-after-free vulnerability     exists in the SharedPtr class (boo#1118346).

  - CVE-2018-19837: Fixed stack overflow in Eval::operator()     (boo#1118348).

  - CVE-2018-19838: Fixed stack-overflow at     IMPLEMENT_AST_OPERATORS expansion (boo#1118349).

  - CVE-2018-19839: Fixed buffer-overflow (OOB read) against     some invalid input (boo#1118351).

  - CVE-2018-20190: Fixed NULL pointer dereference in     Sass::Eval::operator()(Sass::Supports_Operator*)     (boo#1119789).

  - CVE-2018-20821: Fixed uncontrolled recursion in     Sass:Parser:parse_css_variable_value (boo#1133200).

  - CVE-2018-20822: Fixed stack-overflow at     Sass::Inspect::operator() (boo#1133201).

ID	Name	Product	Family	Severity
183625	Ubuntu 18.04 ESM : LibSass vulnerabilities (USN-4837-1)	Nessus	Ubuntu Local Security Checks	critical
126975	openSUSE Security Update : libsass (openSUSE-2019-1791)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2018-19797

medium

Tenable Plugins

critical

critical