CVE Feed

    Dashboard / CVE / CVE-2017-12963

    CVE-2017-12963

    There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but remains exploitable after the vendor's CVE-2017-11555 fix (available from GitHub after 2017-07-24).

    Published:Aug 18, 2017
    Last Modified:Apr 20, 2025
    EPS:Aug 18, 2017
    EPSS Score:0.00401
    CVSS Score:7.5

    Affected Products

    Vendor
    Libsass
    Product
    Libsass

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2017-12964 (CVSS 7.5) — There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() i…
    CVE-2017-12962 (CVSS 7.5) — There are memory leaks in LibSass 3.4.5 triggered by deeply nested code, such as code with a long sequence of …
    CVE-2017-11608 (CVSS 6.5) — There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.…
    CVE-2017-11605 (CVSS 6.5) — There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will l…
    CVE-2017-11554 (CVSS 7.5) — There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4…
    CVE-2017-11556 (CVSS 7.5) — There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass…
    CVE-2017-11555 (CVSS 7.5) — There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted inpu…
    CVE-2017-11341 (CVSS 7.5) — There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5. A crafted input will lead to a remote de…
    CVE-2017-11342 (CVSS 7.5) — There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial o…
    CVE-2017-10687 (CVSS 7.5) — In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High