CVE Feed

    Dashboard / CVE / CVE-2017-10687

    CVE-2017-10687

    In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted input will lead to a remote denial of service attack.

    Published:Jun 29, 2017
    Last Modified:Apr 20, 2025
    EPS:Jun 29, 2017
    EPSS Score:0.00418
    CVSS Score:7.5

    Affected Products

    Vendor
    Libsass
    Product
    Libsass

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2017-12964 (CVSS 7.5) — There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() i…
    CVE-2017-12963 (CVSS 7.5) — There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote…
    CVE-2017-12962 (CVSS 7.5) — There are memory leaks in LibSass 3.4.5 triggered by deeply nested code, such as code with a long sequence of …
    CVE-2017-11608 (CVSS 6.5) — There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.…
    CVE-2017-11605 (CVSS 6.5) — There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will l…
    CVE-2017-11554 (CVSS 7.5) — There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4…
    CVE-2017-11556 (CVSS 7.5) — There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass…
    CVE-2017-11555 (CVSS 7.5) — There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted inpu…
    CVE-2017-11341 (CVSS 7.5) — There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5. A crafted input will lead to a remote de…
    CVE-2017-11342 (CVSS 7.5) — There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High