CVE-2022-43357 - Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS)

Back Back to CVE browser

HIGH

Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS)

Published Aug 22, 2023

7.5

HIGH

CVSS 3.1

EPSS 1.50%

Description

Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (4)

https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/
ExploitPermissions RequiredThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46396
Advisory
https://github.com/sass/libsass
Product
https://github.com/sass/libsass/issues/3177
ExploitIssue TrackingVendor Advisory

Link	Providers	Tags
https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/		ExploitPermissions RequiredThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46396		Advisory
https://github.com/sass/libsass		Product
https://github.com/sass/libsass/issues/3177		ExploitIssue TrackingVendor Advisory