CVE-2018-19797 - In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file

Back Back to CVE browser

MEDIUM

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file

Published Dec 3, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 1.83%

Description

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (5)

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
vendor-advisoryx_refsource_SUSE
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11476
Advisory
https://github.com/sass/libsass/issues/2779
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html		vendor-advisoryx_refsource_SUSE
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11476		Advisory
https://github.com/sass/libsass/issues/2779		x_refsource_MISCPatchThird Party Advisory