Every CVE Search/ Get API key

CVE-2017-8834

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to...

6.5 MediumFix available

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.83%Down 3.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Record
CVE-2017-8834
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Record
CVE-2017-8834
Updated
2026-11-02
EUVDEUVD-2017-17776 No score

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Record
EUVD-2017-17776
Updated
2026-11-03
GitHub AdvisoriesGHSA-8758-v3mx-r8pc 6.5

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to...

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Record
GHSA-8758-v3mx-r8pc
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2017-8834 6.5

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Record
ALPINE-CVE-2017-8834
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Record
CVE-2017-8834
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2017-8834 6.5

The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Record
UBUNTU-CVE-2017-8834
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2019-0389 No score

Updated libcroco packages fix security vulnerability

Updated libcroco packages fix security vulnerabilities:

Heap overflow (input: check end of input before reading a byte) (CVE-2017-7960).

Undefined behavior (tknzr: support only max long rgb values) (CVE-2017-7961).

Denial of service (memory allocation error) via a crafted CSS file (CVE-2017-8834).

Denial of service (infinite loop and CPU consumption) via a crafted CSS file (CVE-2017-8871).

Record
MGASA-2019-0389
Updated
2026-11-02
OSVopenSUSE-SU-2020:0780-1 No score

Security update for libcroco

This update for libcroco fixes the following issues:

Security issues fixed:

  • CVE-2017-8834: Fixed denial of service (memory allocation error) via a crafted CSS file (bsc#1043898).
  • CVE-2017-8871: Fixed denial of service (infinite loop and CPU consumption) via a crafted CSS file (bsc#1043899).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0780-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10932-1 No score

libcroco-0.6.13-3.2 on GA media

These are all security issues fixed in the libcroco-0.6.13-3.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10932-1
Updated
2026-11-02
OSVSUSE-SU-2019:1468-1 No score

Security update for libcroco

This update for libcroco fixes the following issues:

Security issues fixed:

  • CVE-2017-7960: Fixed heap overflow (input: check end of input before reading a byte) (bsc#1034481).
  • CVE-2017-7961: Fixed undefined behavior (tknzr: support only max long rgb values) (bsc#1034482).
  • CVE-2017-8834: Fixed denial of service (memory allocation error) via a crafted CSS file (bsc#1043898).
  • CVE-2017-8871: Fixed denial of service (infinite loop and CPU consumption) via a crafted CSS file (bsc#1043899).
Record
SUSE-SU-2019:1468-1
Updated
2026-11-02
OSVSUSE-SU-2020:1535-1 No score

Security update for libcroco

This update for libcroco fixes the following issues:

Security issues fixed:

  • CVE-2017-8834: Fixed denial of service (memory allocation error) via a crafted CSS file (bsc#1043898).
  • CVE-2017-8871: Fixed denial of service (infinite loop and CPU consumption) via a crafted CSS file (bsc#1043899).
Record
SUSE-SU-2020:1535-1
Updated
2026-11-02
OSVUSN-5389-1 No score

libcroco vulnerabilities

It was discovered that Libcroco was incorrectly accessing data structures when reading bytes from memory, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8 values when processing CSS files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion in one of its parsing functions, which could cause an infinite recursion loop and a stack overflow due to stack consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-12825)

Record
USN-5389-1
Updated
2026-11-02
OSVUSN-6958-1 No score

libcroco vulnerabilities

It was discovered that Libcroco was incorrectly accessing data structures when reading bytes from memory, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8 values when processing CSS files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion in one of its parsing functions, which could cause an infinite recursion loop and a stack overflow due to stack consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-12825)

Record
USN-6958-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libcroco
Alpine:v3.10
 before 0.6.13-r1
0.6.13-r1
libcroco
Alpine:v3.11
 before 0.6.13-r1
0.6.13-r1
libcroco
Alpine:v3.7
 before 0.6.12-r1
0.6.12-r1
libcroco
Alpine:v3.8
 before 0.6.12-r2
0.6.12-r2
libcroco
Alpine:v3.9
 before 0.6.12-r2
0.6.12-r2
libcroco
Mageia:7
From an advisory covering 4 CVEs
 before 0.6.13-1.1.mga7
0.6.13-1.1.mga7
libcroco
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
libcroco
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
libcroco
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
libcroco
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
libcroco
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
libcroco
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
libcroco
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
libcroco
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 4 CVEs
 before 0.6.11-12.3.1
0.6.11-12.3.1
libcroco
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 2 CVEs
 before 0.6.12-4.3.51
0.6.12-4.3.51
libcroco
Ubuntu:Pro:14.04:LTS
 before 0.6.8-2ubuntu1+esm1, plus listed versions
0.6.8-20.6.8-2ubuntu1
0.6.8-2ubuntu1+esm1
libcroco
Ubuntu:Pro:16.04:LTS
 before 0.6.11-1ubuntu0.1~esm1, plus listed versions
0.6.8-30.6.9-10.6.10-10.6.11-1
0.6.11-1ubuntu0.1~esm1
libcroco
Ubuntu:Pro:18.04:LTS
 before 0.6.12-2ubuntu0.1~esm1, plus listed versions
0.6.12-10.6.12-2
0.6.12-2ubuntu0.1~esm1
libcroco
Ubuntu:20.04:LTS
 before 0.6.13-1ubuntu0.1, plus listed versions
0.6.13-1
0.6.13-1ubuntu0.1
libcroco
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 0.6.11-1ubuntu0.1~esm1, plus listed versions
0.6.8-30.6.9-10.6.10-10.6.11-1
0.6.11-1ubuntu0.1~esm1
libcroco
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 0.6.8-2ubuntu1+esm1, plus listed versions
0.6.8-20.6.8-2ubuntu1
0.6.8-2ubuntu1+esm1
libcroco
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 0.6.12-2ubuntu0.1~esm1, plus listed versions
0.6.12-10.6.12-2
0.6.12-2ubuntu0.1~esm1
libcroco
Ubuntu:20.04:LTS
From an advisory covering 4 CVEs
 before 0.6.13-1ubuntu0.1, plus listed versions
0.6.13-1
0.6.13-1ubuntu0.1
libcroco
openSUSE:Leap 15.1
From an advisory covering 2 CVEs
 before 0.6.12-lp151.4.3.1
0.6.12-lp151.4.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-8834 is a medium vulnerability (CVSS 6.5) in Gnome Libcroco, published June 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.83%, the 90th percentile. Fixed in libcroco 0.6.13-r1.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open