CVE-2020-12825

libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.

The libcroco is a standalone Cascading Style Sheet level 2 (CSS2) parsing and manipulation library.

Security Fix(es):

• libcroco: Stack overflow in function cr_parser_parse_any_core in cr-parser.c (CVE-2020-12825)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.

The libcroco is a standalone Cascading Style Sheet level 2 (CSS2) parsing and manipulation library.

Security Fix(es):

• libcroco: Stack overflow in function cr_parser_parse_any_core in cr-parser.c (CVE-2020-12825)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Stack exhaustion via unbounded parser recursion
  • debian/patches/CVE-2020-12825.patch: limit recursion depth in cr_parser_parse_block_core() and cr_parser_parse_any_core() (src/cr-parser.c)
  • CVE-2020-12825

libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption (CVE-2020-12825).

This update for libcroco fixes the following issues:

• CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for libcroco fixes the following issues:

• CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685).

These are all security issues fixed in the cinnamon-5.0.5-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gnome-extensions-40.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libcroco-0.6.13-3.2 package on the GA media of openSUSE Tumbleweed.

This update for libcroco fixes the following issues:

• CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685).

This update for libcroco fixes the following issues:

• CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685).

This update for libcroco fixes the following issues:

• CVE-2020-12825: Fixed an uncontrolled recursion issue (bsc#1171685).

This update for libcroco fixes the following issues:

• CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685).

It was discovered that Libcroco was incorrectly accessing data structures when reading bytes from memory, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8 values when processing CSS files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion in one of its parsing functions, which could cause an infinite recursion loop and a stack overflow due to stack consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-12825)

It was discovered that Libcroco was incorrectly accessing data structures when reading bytes from memory, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8 values when processing CSS files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion in one of its parsing functions, which could cause an infinite recursion loop and a stack overflow due to stack consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-12825)