CVE-2017-7960

What it actually does

Heap-based buffer over-read in libcroco's cr_input_new_from_uri function during parsing of specially crafted CSS input, leading to denial of service.

Why it matters to the business

Applications that process untrusted CSS files can be crashed, interrupting services such as content rendering or user-upload handling in affected platforms like older Moodle deployments; the issue is years old with low current exploitation likelihood.

How an attack unfolds

An attacker crafts a malicious CSS file that triggers an out-of-bounds read inside libcroco when the cr_input_new_from_uri function processes the URI reference; the malformed file is supplied to any application using the vulnerable library (for example via user-uploaded themes or stylesheets), causing the process to crash.

How to fix it

Upgrade affected packages to the fixed versions; for Moodle (Bitnami) this means moving to version 3.5.18 or later. Where an upgrade path is unavailable, isolate CSS processing or implement strict input validation before handing files to libcroco.

How to confirm the fix worked

Confirm the installed libcroco version is newer than 0.6.12 and that the application reports the patched release (for example Moodle 3.5.18); re-test by feeding a previously crashing CSS sample and verifying the process no longer terminates.

Typical attack path

1. Identify an application endpoint that accepts or processes CSS files using libcroco
2. Craft a CSS file containing a URI that causes the buffer over-read in cr_input_new_from_uri
3. Deliver the file through the normal upload or import path
4. Trigger parsing of the stylesheet
5. Observe application crash or denial of service

How to detect it

Review web-server and application logs for repeated failures or segmentation faults during CSS parsing or theme import operations; look for sudden process terminations coinciding with user-supplied stylesheet activity.

What your security team should do

• Apply the vendor-supplied update to Moodle 3.5.18 or newer immediately
• Inventory all systems that embed or depend on libcroco 0.6.11/0.6.12
• Add CSS upload paths to web-application firewall rules that limit file size and content patterns
• Monitor for sudden application restarts or crashes correlated with stylesheet processing