You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.
In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.
LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).
The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Vulnerabilities
Details
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.
Publish Date: 2018-05-26
URL: CVE-2018-11499
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2018-05-26
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-12-03
URL: CVE-2018-19827
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2018-12-03
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-06-04
URL: CVE-2018-11694
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2018-06-04
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11698
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.5.5
Release Date: 2018-06-04
Fix Resolution: libsass - 3.5.5;node-sass - 4.14.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11697
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2018-06-04
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.
Publish Date: 2019-01-14
URL: CVE-2019-6284
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2020-08-24
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.
Publish Date: 2019-01-14
URL: CVE-2019-6286
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2019-07-23
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).
Publish Date: 2019-04-23
URL: CVE-2018-20822
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.5.5
Release Date: 2019-04-23
Fix Resolution: libsass - 3.5.5;node-sass - 4.14.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).
Publish Date: 2019-04-23
URL: CVE-2018-20821
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2019-04-23
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.
Publish Date: 2019-11-06
URL: CVE-2019-18797
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-18797
Release Date: 2019-11-08
Fix Resolution: GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105;node-sass - 4.14.0,4.8.0;Fable.Template.Elmish.React - 0.1.6
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.
Publish Date: 2019-01-14
URL: CVE-2019-6283
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2020-08-24
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-17
URL: CVE-2018-20190
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2018-12-17
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().
Publish Date: 2018-12-04
URL: CVE-2018-19838
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.5.5
Release Date: 2018-12-04
Fix Resolution: libsass - 3.5.5;node-sass - 4.14.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - opennmsopennms-source-26.0.0-1
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in base branch: devel
Vulnerable Source Files (1)
Vulnerability Details
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-03
URL: CVE-2018-19797
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/sass/libsass/releases/tag/3.6.0
Release Date: 2018-12-03
Fix Resolution: libsass - 3.6.0
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: