The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libcroco | Nov 8, 2019 | Apr 19, 2017 |
| Debian | — | Upgrade libcroco | Apr 23, 2017 | Apr 19, 2017 |
| Gentoo Linux | — | Upgrade dev-libs/libcroco. | Oct 30, 2017 | Apr 19, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libcroco | Dec 4, 2019 | Apr 19, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libcroco | Dec 18, 2019 | Apr 19, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libcroco | Nov 19, 2019 | Apr 19, 2017 |
| Oracle Solaris | — | Upgrade library/libcroco to version 0.6.2-0.175.3.23.0.3.0 on Solaris 11.3 | Aug 21, 2017 | Apr 19, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2017 |
| Suse | — | Upgrade libcroco-0_6-3Upgrade libcroco-develUpgrade libcroco-0_6-3-32bitUpgrade libcroco | May 20, 2018 | Apr 19, 2017 |
| Ubuntu | — | Upgrade libcroco-tools (Ubuntu Pro)Upgrade libcroco3 (Ubuntu Pro) | Apr 27, 2022 | Apr 19, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub