CVE-2017-8871
Medium · 6.5CVSS
6.5
EPSS
12.9%
Published
Jun 12, 2017
CISA due date
—
The record
The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.10 | libcroco | 0 | 0.6.13-r1 |
| Alpine:v3.11 | libcroco | 0 | 0.6.13-r1 |
| Alpine:v3.7 | libcroco | 0 | 0.6.12-r1 |
| Alpine:v3.8 | libcroco | 0 | 0.6.12-r2 |
| Alpine:v3.9 | libcroco | 0 | 0.6.12-r2 |
| Debian:10 | libcroco | 0 | No fix |
| Mageia:7 | libcroco | 0 | 0.6.13-1.1.mga7 |
| SUSE:Linux Enterprise Desktop 12 SP3 | libcroco | 0 | 0.6.11-12.3.1 |
| SUSE:Linux Enterprise Desktop 12 SP4 | libcroco | 0 | 0.6.11-12.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP1 | libcroco | 0 | 0.6.12-4.3.51 |
| SUSE:Linux Enterprise Server 12 SP3 | libcroco | 0 | 0.6.11-12.3.1 |
| SUSE:Linux Enterprise Server 12 SP4 | libcroco | 0 | 0.6.11-12.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | libcroco | 0 | 0.6.11-12.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | libcroco | 0 | 0.6.11-12.3.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP3 | libcroco | 0 | 0.6.11-12.3.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP4 | libcroco | 0 | 0.6.11-12.3.1 |
| Ubuntu:20.04:LTS | libcroco | 0 | No fix |
| Ubuntu:20.04:LTS | libcroco | 0 | 0.6.13-1ubuntu0.1 |
| Ubuntu:Pro:14.04:LTS | libcroco | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | libcroco | 0 | 0.6.8-2ubuntu1+esm1 |
| Ubuntu:Pro:16.04:LTS | libcroco | 0 | 0.6.11-1ubuntu0.1~esm1 |
| Ubuntu:Pro:18.04:LTS | libcroco | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libcroco | 0 | 0.6.12-2ubuntu0.1~esm1 |
| openSUSE:Leap 15.1 | libcroco | 0 | 0.6.12-lp151.4.3.1 |
Related vulnerabilities
- CVE-2017-7960 The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows… Also affects libcroco
- CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-835
- CVE-2026-119205 pypdf is a free and open-source pure-python PDF library. CWE-835
- CVE-2026-119203 pypdf is a free and open-source pure-python PDF library. CWE-835
- CVE-2026-118781 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-835
- CVE-2026-111731 P-Net before 1.0.3 enters an infinite loop when handling a read request for the… CWE-835
- CVE-2026-111496 Kafka Streams derives its stream-time clock from record timestamps. CWE-835
- CVE-2026-103410 An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks… CWE-835