{"id":"CVE-2018-19827","aliases":["AZL-70997","DEBIAN-CVE-2018-19827","EUVD-2018-11502","GHSA-69g9-qc4v-m973","JLSEC-2026-502","MGASA-2020-0049","UBUNTU-CVE-2018-19827","USN-4837-1","openSUSE-SU-2019:1791-1","openSUSE-SU-2019:1800-1","openSUSE-SU-2019:1883-1","openSUSE-SU-2024:10988-1"],"status":"published","title":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp ...","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02044,"percentile":0.81314,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2018-12-03T19:00:00Z","modified":"2026-10-24T10:48:40Z","fixes":[{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-21"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsass","fixed_in":["3.5.5-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsass","fixed_in":["3.5.5-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsass","fixed_in":["3.5.5-3"],"sources":["osv"]},{"ecosystem":"Julia","package":"libsass_jll","fixed_in":["3.6.4+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsass","fixed_in":["3.4.8-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-21"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-3"}]}]},{"source":"osv","ecosystem":"Julia","package":"libsass_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu0.1~esm1"}]}],"versions":["3.4.3-1","3.4.6-1","3.4.8-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu0.1~esm1"}]}],"versions":["3.4.3-1","3.4.6-1","3.4.8-1"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-lp151.3.3.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-lp151.3.3.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-bp150.3.3.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-bp151.4.3.1"}]}],"bundled":12}],"products":[{"vendor":"sass-lang","product":"libsass"}],"references":[{"url":"https://github.com/sass/libsass/issues/2782","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19827","tags":["web"]},{"url":"https://github.com/advisories/GHSA-69g9-qc4v-m973"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19827","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0049.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25755","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-07/msg00119.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-19827","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4837-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6286","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME/#YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1096894","tags":["report"]},{"url":"https://bugzilla.suse.com/1118301","tags":["report"]},{"url":"https://bugzilla.suse.com/1118346","tags":["report"]},{"url":"https://bugzilla.suse.com/1118348","tags":["report"]},{"url":"https://bugzilla.suse.com/1118349","tags":["report"]},{"url":"https://bugzilla.suse.com/1118351","tags":["report"]},{"url":"https://bugzilla.suse.com/1119789","tags":["report"]},{"url":"https://bugzilla.suse.com/1121943","tags":["report"]},{"url":"https://bugzilla.suse.com/1121944","tags":["report"]},{"url":"https://bugzilla.suse.com/1121945","tags":["report"]},{"url":"https://bugzilla.suse.com/1133200","tags":["report"]},{"url":"https://bugzilla.suse.com/1133201","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6286","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TKUSHJ5N3XI2SULIOHCBE47TMJ7A5XA4/#TKUSHJ5N3XI2SULIOHCBE47TMJ7A5XA4","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6/#HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-19827","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-12-03T19:00:00Z","modified":"2024-08-05T11:44:20.494Z","updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2018-11502","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-12-03T19:00:00Z","modified":"2024-08-05T11:44:20Z","updated_at":"2026-11-03T02:39:32.468376Z"}],"ghsa":[{"id":"GHSA-69g9-qc4v-m973","title":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp ...","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2022-05-14T00:55:58Z","modified":"2023-02-02T05:02:42Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:51:29.873049Z"}],"nvd":[{"id":"CVE-2018-19827","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-12-03T19:29:00.397Z","modified":"2026-06-17T01:49:57.113Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:49.995593Z"}],"osv":[{"id":"AZL-70997","title":"CVE-2018-19827 affecting package reaper for versions less than 3.1.1-21","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-12-03T19:29:00Z","modified":"2026-04-21T04:36:30.469683Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"CVE-2018-19827","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-12-03T19:29:00.397Z","modified":"2026-10-24T10:48:40.833595856Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19827","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-12-03T19:29:00.397Z","modified":"2026-10-23T18:03:04.141791794Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"JLSEC-2026-502","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2026-05-18T14:23:04.937Z","modified":"2026-07-18T00:00:49.265013466Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"UBUNTU-CVE-2018-19827","description":"In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-12-03T19:29:00Z","modified":"2026-04-22T11:50:37.803683Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"MGASA-2020-0049","title":"Updated libsass packages fix security vulnerabilities","description":"Use-after-free vulnerability in sass_context.cpp:handle_error\n(CVE-2018-11499).\n\nNull pointer dereference in Sass::Selector_List::populate_extends\n(CVE-2018-19797).\n\nUse-after-free vulnerability exists in the SharedPtr class\n(CVE-2018-19827).\n\nStack overflow in Eval::operator() (CVE-2018-19837).\n\nStack-overflow at IMPLEMENT_AST_OPERATORS expansion (CVE-2018-19838).\n\nBuffer-overflow (OOB read) against some invalid input (CVE-2018-19839).\n\nNull pointer dereference in Sass::Eval::operator()\n(Sass::Supports_Operator*)\n(CVE-2018-20190).\n\nUncontrolled recursion in Sass:Parser:parse_css_variable_value\n(CVE-2018-20821).\n\nStack-overflow at Sass::Inspect::operator() (CVE-2018-20822).\n\nHeap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*)\n(CVE-2019-6283).\n\nHeap-based buffer over-read exists in Sass:Prelexer:alternatives\n(CVE-2019-6284).\n\nHeap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes\n(CVE-2019-6286).\n","status":"published","published":"2020-01-28T07:52:40Z","modified":"2026-04-16T04:42:33.365747836Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:1791-1","title":"Security update for libsass","description":"This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n","status":"published","published":"2019-07-23T11:22:02Z","modified":"2025-05-07T18:09:59.045941Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1800-1","title":"Security update for libsass","description":"This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-07-24T08:46:14Z","modified":"2026-02-04T02:55:58.063245Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1883-1","title":"Security update for libsass","description":"This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-08-14T10:51:26Z","modified":"2025-05-07T18:09:59.168246Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10988-1","title":"libsass-3_6_5-1-3.6.5-1.2 on GA media","description":"These are all security issues fixed in the libsass-3_6_5-1-3.6.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:05:18.843552Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4837-1","title":"libsass vulnerabilities","description":"It was discovered that LibSass incorrectly handled certain specially crafted\nsass file. An attacker could possibly use this issue to cause a denial of\nservice or other unspecified impact.","status":"published","published":"2021-03-15T22:19:52Z","modified":"2026-04-27T16:03:38.309150864Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}