CVE Feed

    Dashboard / CVE / CVE-2017-12962

    CVE-2017-12962

    There are memory leaks in LibSass 3.4.5 triggered by deeply nested code, such as code with a long sequence of open parenthesis characters, leading to a remote denial of service attack.

    Published:Aug 18, 2017
    Last Modified:Apr 20, 2025
    EPS:Aug 18, 2017
    EPSS Score:0.00401
    CVSS Score:7.5

    Affected Products

    Vendor
    Libsass
    Product
    Libsass

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-469 HTTP DoS

    Related CVEs

    CVE-2017-12964 (CVSS 7.5) — There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() i…
    CVE-2017-12963 (CVSS 7.5) — There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote…
    CVE-2017-11608 (CVSS 6.5) — There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.…
    CVE-2017-11605 (CVSS 6.5) — There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will l…
    CVE-2017-11554 (CVSS 7.5) — There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4…
    CVE-2017-11556 (CVSS 7.5) — There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass…
    CVE-2017-11555 (CVSS 7.5) — There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted inpu…
    CVE-2017-11341 (CVSS 7.5) — There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5. A crafted input will lead to a remote de…
    CVE-2017-11342 (CVSS 7.5) — There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial o…
    CVE-2017-10687 (CVSS 7.5) — In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High