Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 568
Alerts This Week
Warning Icon 1 568

Ubuntu 16.04 ESM USN-5389-1 Critical: Libcroco DoS Issues

ubuntu
Calendar Grey April 26, 2022
Dist Ubuntu Esm H88
Apply the latest patch to mitigate Libcroco vulnerabilities in Ubuntu 16.04, safeguarding against possible denial of service threats.
Several security issues were fixed in Libcroco.

Summary

Several security issues were fixed in Libcroco.

Software Description:

- libcroco: Cascading Style Sheet (CSS) parsing and manipulation toolkit

Details:

It was discovered that Libcroco was incorrectly accessing data

structures when

reading bytes from memory, which could cause a heap buffer overflow. An

attacker

could possibly use this issue to cause a denial of service. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8

values

when processing CSS files. An attacker could possibly use this issue to

cause

a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion

in one

of its parsing functions, which could cause an infinite recursion loop and a

stack overflow due to stack consumption. An attacker could possibly use this

issue to cause a denial of service. (CVE-2020-12825)

Topics%20covered

Topics Covered

security advisory security issue DoS Ubuntu heap overflow CSS parsing Libcroco

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
libcroco-tools 0.6.11-1ubuntu0.1~esm1
libcroco3 0.6.11-1ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References

CVE-2017-7960, CVE-2017-8834, CVE-2017-8871, CVE-2020-12825

Severity
critical
Lowest
Low
Medium
High
Critical

April 26, 2022

Topics%20covered

Topics Covered

security advisory security issue DoS Ubuntu heap overflow CSS parsing Libcroco

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.