{"id":"CVE-2017-7961","aliases":["ALPINE-CVE-2017-7961","DLA-909-1","EUVD-2017-16931","GHSA-w464-8qjc-r5gx","MGASA-2019-0389","SUSE-SU-2019:1468-1","openSUSE-SU-2024:10932-1"],"status":"disputed","title":"** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an...","description":"The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \"outside the range of representable values of type long\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \"This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01966,"percentile":0.80497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-04-19T15:00:00Z","modified":"2026-06-17T01:25:32Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libcroco","fixed_in":["0.6.13-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libcroco","fixed_in":["0.6.13-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libcroco","fixed_in":["0.6.12-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libcroco","fixed_in":["0.6.12-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libcroco","fixed_in":["0.6.12-r2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.13-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.13-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.12-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.12-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.12-r2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.6-2+deb7u1"}]}],"versions":["0.6.6-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.13-1.1.mga7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libcroco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11-12.3.1"}]}],"bundled":4}],"products":[{"vendor":"gnome","product":"libcroco"}],"references":[{"url":"https://git.gnome.org/browse/libcroco/commit/?id=9ad72875e9f08e4c519ef63d44cdbd94aa9504f7","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/201707-13","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://openwall.com/lists/oss-security/2017/04/24/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1034482","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior/","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7961"},{"url":"https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior"},{"url":"https://github.com/advisories/GHSA-w464-8qjc-r5gx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-7961","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0389.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21057","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-06/msg00092.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191468-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034481","tags":["report"]},{"url":"https://bugzilla.suse.com/1034482","tags":["report"]},{"url":"https://bugzilla.suse.com/1043898","tags":["report"]},{"url":"https://bugzilla.suse.com/1043899","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8871","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12825","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7961","description":"The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \"outside the range of representable values of type long\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \"This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.","status":"disputed","published":"2017-04-19T15:00:00Z","modified":"2024-08-05T16:19:29.446Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16931","description":"The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \"outside the range of representable values of type long\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \"This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.","status":"published","published":"2017-04-19T15:00:00Z","modified":"2024-08-05T16:19:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:39:06.470138Z"}],"ghsa":[{"id":"GHSA-w464-8qjc-r5gx","title":"** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an...","description":"** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \"outside the range of representable values of type long\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \"This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.\"","status":"published","published":"2022-05-14T00:58:06Z","modified":"2024-03-30T05:01:20Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:55:44.111751Z"}],"nvd":[{"id":"CVE-2017-7961","description":"The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \"outside the range of representable values of type long\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \"This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.","status":"disputed","published":"2017-04-19T15:59:00.21Z","modified":"2026-06-17T01:25:32.983Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"ALPINE-CVE-2017-7961","description":"The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \"outside the range of representable values of type long\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \"This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.","status":"published","published":"2017-04-19T15:59:00.21Z","modified":"2026-06-15T18:24:54.594632555Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2017-7961","description":"The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \"outside the range of representable values of type long\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \"This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.","status":"published","published":"2017-04-19T15:59:00.21Z","modified":"2026-04-16T04:33:31.565045054Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DLA-909-1","title":"libcroco - security update","status":"published","published":"2017-04-23T00:00:00Z","modified":"2026-03-09T02:10:36.525677Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"MGASA-2019-0389","title":"Updated libcroco packages fix security vulnerability","description":"Updated libcroco packages fix security vulnerabilities:\n\nHeap overflow (input: check end of input before reading a byte)\n(CVE-2017-7960).\n\nUndefined behavior (tknzr: support only max long rgb values)\n(CVE-2017-7961).\n\nDenial of service (memory allocation error) via a crafted CSS file\n(CVE-2017-8834).\n\nDenial of service (infinite loop and CPU consumption) via a crafted CSS\nfile (CVE-2017-8871).\n","status":"published","published":"2019-12-15T18:03:05Z","modified":"2026-04-16T04:41:25.772333506Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:10932-1","title":"libcroco-0.6.13-3.2 on GA media","description":"These are all security issues fixed in the libcroco-0.6.13-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:11.67267Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:1468-1","title":"Security update for libcroco","description":"This update for libcroco fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-7960: Fixed heap overflow (input: check end of input before reading a byte) (bsc#1034481).                                                                    \n- CVE-2017-7961: Fixed undefined behavior (tknzr: support only max long rgb values) (bsc#1034482).                                                                       \n- CVE-2017-8834: Fixed denial of service (memory allocation error) via a crafted CSS file (bsc#1043898).\n- CVE-2017-8871: Fixed denial of service (infinite loop and CPU consumption) via a crafted CSS file (bsc#1043899).\n","status":"published","published":"2019-06-12T08:01:48Z","modified":"2026-02-04T03:16:17.176399Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}