Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-8834 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libcroco

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer12 documents7 sources
Severity
6.5MEDIUMNVD
OSV5.5
EPSS
1.1%
top 22.14%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Gnome LibcrocoOpensuse Leap
Timeline
PublishedJun 12
Latest updateAug 13

Description

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Alpinegnome/libcroco< 0.6.13-r1+4
▶Ubuntugnome/libcroco< 0.6.13-1ubuntu0.1+3
▶NVDgnome/libcroco0.6.12
▶NVDopensuse/leap42.3

🔴Vulnerability Details

4
OSV
libcroco vulnerabilities↗2024-08-13
▶
GHSA
GHSA-8758-v3mx-r8pc: The cr_tknzr_parse_comment function in cr-tknzr↗2022-05-13
▶
OSV
libcroco vulnerabilities↗2022-04-26
▶
OSV
CVE-2017-8834: The cr_tknzr_parse_comment function in cr-tknzr↗2017-06-12
▶

💥Exploits & PoCs

1
Exploit-DB
libcroco 0.6.12 - Denial of Service↗2017-06-09
▶

📋Vendor Advisories

3
Ubuntu
Libcroco vulnerabilities↗2024-08-13
▶
Ubuntu
Libcroco vulnerabilities↗2022-04-26
▶
Red Hat
libcroco: Memory allocation failure in the cr_tknzr_parse_comment function↗2017-06-07
▶

💬Community

3
Bugzilla
CVE-2017-8834 libcroco: Memory allocation failure in the cr_tknzr_parse_comment function↗2017-06-20
▶
Bugzilla
CVE-2017-8834 CVE-2017-8871 mingw-libcroco: various flaws [fedora-all]↗2017-06-20
▶
Bugzilla
CVE-2017-8834 CVE-2017-8871 libcroco: various flaws [fedora-all]↗2017-06-20
▶