Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2.
References
| Link | Resource |
|---|---|
| https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/ | Exploit Permissions Required Third Party Advisory |
| https://github.com/sass/libsass | Product |
| https://github.com/sass/libsass/issues/3177 | Exploit Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
31 Aug 2023, 14:23
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sass-lang
Sass-lang sassc Sass-lang libsass |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:* cpe:2.3:a:sass-lang:sassc:3.6.2:*:*:*:*:*:*:* |
|
| CWE | CWE-787 | |
| References | (MISC) https://github.com/sass/libsass/issues/3177 - Exploit, Issue Tracking, Vendor Advisory | |
| References | (MISC) https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/ - Exploit, Permissions Required, Third Party Advisory | |
| References | (MISC) https://github.com/sass/libsass - Product |
22 Aug 2023, 20:10
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-22 19:16
Updated : 2023-12-10 15:14
NVD link : CVE-2022-43357
Mitre link : CVE-2022-43357
CVE.ORG link : CVE-2022-43357
JSON object : View
Products Affected
sass-lang
- libsass
- sassc
CWE
CWE-787
Out-of-bounds Write