CVE-2017-7961 Integer overflow in n/a
A crafted CSS file can cause an application crash in libcroco due to undefined behavior in RGB parsing, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-7961?
CVE-2017-7961 is a high-severity vulnerability in n/a, published on 19 Apr 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.
Weakness: CWE-119
Which versions are affected by CVE-2017-7961?
It affects 1 product.
Products include Gnome Libcroco.
How do I fix CVE-2017-7961?
Apply the vendor's patch.
Is CVE-2017-7961 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-7961 exists.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2017-7961, GHSA-w464-8qjc-r5gx.