CVE-2018-19838

MEDIUM

libsass < 3.5.5 - Denial of Service via Recursive AST Operator Expansion

Title source: llm

Description

In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().

References (4)

Core 4

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/sass/libsass/issues/2660

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html

Scores

CVSS v3 6.5

EPSS 0.0194

EPSS Percentile 77.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE

CWE-400

Status published

Products (1)

sass-lang/libsass < 3.5.5

Published Dec 04, 2018

Tracked Since Feb 18, 2026