Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-8871 — Infinite Loop in Libcroco

CWE-835 — Infinite Loop13 documents8 sources
Severity
6.5MEDIUMNVD
OSV5.5
EPSS
1.7%
top 17.57%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Gnome LibcrocoOpensuse Leap
Timeline
PublishedJun 12
Latest updateAug 13

Description

The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Alpinegnome/libcroco< 0.6.13-r1+4
▶Ubuntugnome/libcroco< 0.6.13-1ubuntu0.1+3
▶NVDgnome/libcroco0.6.12
▶NVDopensuse/leap42.3

🔴Vulnerability Details

5
OSV
libcroco vulnerabilities↗2024-08-13
▶
GHSA
GHSA-xxqh-r526-fmp5: The cr_parser_parse_selector_core function in cr-parser↗2022-05-13
▶
OSV
libcroco vulnerabilities↗2022-04-26
▶
CVEList
CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser↗2017-06-12
▶
OSV
CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser↗2017-06-12
▶

💥Exploits & PoCs

1
Exploit-DB
libcroco 0.6.12 - Denial of Service↗2017-06-09
▶

📋Vendor Advisories

3
Ubuntu
Libcroco vulnerabilities↗2024-08-13
▶
Ubuntu
Libcroco vulnerabilities↗2022-04-26
▶
Red Hat
libcroco: Infinite loop in the cr_parser_parse_selector_core function↗2017-06-07
▶

💬Community

3
Bugzilla
CVE-2017-8871 libcroco: Infinite loop in the cr_parser_parse_selector_core function↗2017-06-20
▶
Bugzilla
CVE-2017-8834 CVE-2017-8871 mingw-libcroco: various flaws [fedora-all]↗2017-06-20
▶
Bugzilla
CVE-2017-8834 CVE-2017-8871 libcroco: various flaws [fedora-all]↗2017-06-20
▶