CVE-2017-7960

5.5MEDIUM

Key Information:

Vendor
Gnome
Status
Libcroco
Vendor
CVE Published:
19 April 2017

Summary

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.

References

https://security.gentoo.org/glsa/201707-13
vendor-advisoryx_refsource_GENTOO
https://git.gnome.org/browse/libcroco/commit/?id=898e3a8c...
x_refsource_MISC
https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-ove...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.