CVE-2019-6286 Memory corruption in n/a

Medium 6.5 Published 14 Jan 2019 Updated 4 Aug 2024

A heap-based buffer over-read in LibSass allows attackers to cause a denial of service via crafted Sass import statements.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-6286?

CVE-2019-6286 is a medium-severity memory corruption vulnerability in n/a, published on 14 Jan 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.

Weakness: CWE-125

Which versions are affected by CVE-2019-6286?

It affects 1 product.

Products include Sass-Lang Libsass.

How do I fix CVE-2019-6286?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-6286 being exploited?

There is no known exploitation of CVE-2019-6286 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-6286, GHSA-v472-248w-rwx2, JLSEC-2026-510, UBUNTU-CVE-2019-6286.