{"id":"CVE-2018-20190","aliases":["DEBIAN-CVE-2018-20190","EUVD-2018-12757","GHSA-f9vp-f9xq-w8wr","JLSEC-2026-503","MGASA-2020-0049","UBUNTU-CVE-2018-20190","USN-4837-1","openSUSE-SU-2019:1791-1","openSUSE-SU-2019:1800-1","openSUSE-SU-2019:1883-1","openSUSE-SU-2024:10988-1"],"status":"published","title":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass:...","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02587,"percentile":0.85365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-12-17T20:00:00Z","modified":"2026-10-24T10:48:41Z","fixes":[{"ecosystem":"Debian:12","package":"libsass","fixed_in":["3.5.5-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsass","fixed_in":["3.5.5-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsass","fixed_in":["3.5.5-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"libsass_jll","fixed_in":["3.6.4+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsass","fixed_in":["3.4.8-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-4"}]}]},{"source":"osv","ecosystem":"Julia","package":"libsass_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu0.1~esm1"}]}],"versions":["3.4.3-1","3.4.6-1","3.4.8-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu0.1~esm1"}]}],"versions":["3.4.3-1","3.4.6-1","3.4.8-1"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-lp151.3.3.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-lp151.3.3.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-bp150.3.3.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"libsass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-bp151.4.3.1"}]}],"bundled":12}],"products":[{"vendor":"sass-lang","product":"libsass"}],"references":[{"url":"http://www.securityfocus.com/bid/106232","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/sass/libsass/issues/2786","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20190"},{"url":"https://github.com/advisories/GHSA-f9vp-f9xq-w8wr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-20190","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0049.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25755","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-07/msg00119.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-20190","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4837-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6286","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME/#YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1096894","tags":["report"]},{"url":"https://bugzilla.suse.com/1118301","tags":["report"]},{"url":"https://bugzilla.suse.com/1118346","tags":["report"]},{"url":"https://bugzilla.suse.com/1118348","tags":["report"]},{"url":"https://bugzilla.suse.com/1118349","tags":["report"]},{"url":"https://bugzilla.suse.com/1118351","tags":["report"]},{"url":"https://bugzilla.suse.com/1119789","tags":["report"]},{"url":"https://bugzilla.suse.com/1121943","tags":["report"]},{"url":"https://bugzilla.suse.com/1121944","tags":["report"]},{"url":"https://bugzilla.suse.com/1121945","tags":["report"]},{"url":"https://bugzilla.suse.com/1133200","tags":["report"]},{"url":"https://bugzilla.suse.com/1133201","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6286","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TKUSHJ5N3XI2SULIOHCBE47TMJ7A5XA4/#TKUSHJ5N3XI2SULIOHCBE47TMJ7A5XA4","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6/#HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-20190","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2018-12-17T20:00:00Z","modified":"2024-08-05T11:58:18.151Z","updated_at":"2026-11-02T14:35:00.237825Z"}],"euvd":[{"id":"EUVD-2018-12757","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2018-12-17T20:00:00Z","modified":"2024-08-05T11:58:18Z","updated_at":"2026-11-03T02:39:31.423203Z"}],"ghsa":[{"id":"GHSA-f9vp-f9xq-w8wr","title":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass:...","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2022-05-14T00:55:58Z","modified":"2023-02-02T05:02:36Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:51:28.758736Z"}],"nvd":[{"id":"CVE-2018-20190","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2018-12-17T20:29:00.31Z","modified":"2026-06-17T01:52:26.01Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-20190","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2018-12-17T20:29:00.31Z","modified":"2026-10-24T10:48:41.002005904Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-20190","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2018-12-17T20:29:00.31Z","modified":"2026-10-23T18:03:20.999958664Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"JLSEC-2026-503","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(`Sass::Supports_Operator`*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2026-05-18T14:23:04.937Z","modified":"2026-07-25T18:24:32.110896721Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"UBUNTU-CVE-2018-20190","description":"In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.","status":"published","published":"2018-12-17T20:29:00Z","modified":"2026-04-22T11:51:49.66447Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"MGASA-2020-0049","title":"Updated libsass packages fix security vulnerabilities","description":"Use-after-free vulnerability in sass_context.cpp:handle_error\n(CVE-2018-11499).\n\nNull pointer dereference in Sass::Selector_List::populate_extends\n(CVE-2018-19797).\n\nUse-after-free vulnerability exists in the SharedPtr class\n(CVE-2018-19827).\n\nStack overflow in Eval::operator() (CVE-2018-19837).\n\nStack-overflow at IMPLEMENT_AST_OPERATORS expansion (CVE-2018-19838).\n\nBuffer-overflow (OOB read) against some invalid input (CVE-2018-19839).\n\nNull pointer dereference in Sass::Eval::operator()\n(Sass::Supports_Operator*)\n(CVE-2018-20190).\n\nUncontrolled recursion in Sass:Parser:parse_css_variable_value\n(CVE-2018-20821).\n\nStack-overflow at Sass::Inspect::operator() (CVE-2018-20822).\n\nHeap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*)\n(CVE-2019-6283).\n\nHeap-based buffer over-read exists in Sass:Prelexer:alternatives\n(CVE-2019-6284).\n\nHeap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes\n(CVE-2019-6286).\n","status":"published","published":"2020-01-28T07:52:40Z","modified":"2026-04-16T04:42:33.365747836Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:1791-1","title":"Security update for libsass","description":"This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n","status":"published","published":"2019-07-23T11:22:02Z","modified":"2025-05-07T18:09:59.045941Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1800-1","title":"Security update for libsass","description":"This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-07-24T08:46:14Z","modified":"2026-02-04T02:55:58.063245Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1883-1","title":"Security update for libsass","description":"This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-08-14T10:51:26Z","modified":"2025-05-07T18:09:59.168246Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10988-1","title":"libsass-3_6_5-1-3.6.5-1.2 on GA media","description":"These are all security issues fixed in the libsass-3_6_5-1-3.6.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:05:18.843552Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4837-1","title":"libsass vulnerabilities","description":"It was discovered that LibSass incorrectly handled certain specially crafted\nsass file. An attacker could possibly use this issue to cause a denial of\nservice or other unspecified impact.","status":"published","published":"2021-03-15T22:19:52Z","modified":"2026-04-27T16:03:38.309150864Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}