USN-6958-1: Libcroco vulnerabilities
It was discovered that Libcroco was incorrectly accessing data structures when reading bytes from memory, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2017-7960) It was discovered that Libcroco was incorrectly handling invalid UTF-8 values when processing CSS files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871) It was discovered that Libcroco was incorrectly implementing recursion in one of its parsing functions, which could cause an infinite recursion loop and a stack overflow due to stack consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-12825)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6958-1?
The vulnerability USN-6958-1 is classified as a heap buffer overflow that could lead to a denial of service.
How do I fix USN-6958-1?
To fix USN-6958-1, you should upgrade libcroco to version 0.6.13-1ubuntu0.1 or later on affected Ubuntu systems.
Which versions of Ubuntu are affected by USN-6958-1?
USN-6958-1 affects Ubuntu 14.04 LTS, 18.04 LTS, and 20.04 LTS for specific versions of libcroco.
What could an attacker achieve by exploiting USN-6958-1?
An attacker could leverage USN-6958-1 to cause a denial of service by causing a heap buffer overflow.
Is USN-6958-1 specific to any packages?
Yes, USN-6958-1 specifically affects the libcroco3 and libcroco-tools packages on the mentioned Ubuntu versions.