Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2018-19839
Good to know:
Date: December 4, 2018
In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.
Language: C++
Severity Score
Related Resources (7)
Severity Score
Weakness Type (CWE)
Out-of-bounds Read
CWE-125Top Fix
Upgrade Version
Upgrade to version saphyr-solutions/saphyr-web-generator - 1.0.x-dev;saphyr-solutions/saphyr-web-generator - dev-ppe;saphyr-solutions/saphyr-web-generator - no_fix;chrisbraybrooke/laravel-ecommerce - 0.0.2;chrisbraybrooke/laravel-ecommerce - 0.0.56;chrisbraybrooke/laravel-ecommerce - 0.0.17;chrisbraybrooke/laravel-ecommerce - dev-form-field-key;islandora/islandora_base_theme - dev-thumbnail-speed-patch;islandora/islandora_base_theme - no_fix;islandora/islandora_base_theme - dev-bd-d9-updates;scancode/portal-module - dev-dependabot/npm_and_yarn/Resources/assets/coreui/path-parse-1.0.7;scancode/portal-module - v1.0.12;scancode/portal-module - dev-dependabot/npm_and_yarn/Resources/assets/coreui/decode-uri-component-0.2.2;utf8-cpp - no_fix;rs_osrm - no_fix;yivic/yivic-elce - no_fix;greenpeace/planet4-child-theme-storytelling - v0.9.7;greenpeace/planet4-child-theme-storytelling - dev-old-ui;greenpeace/planet4-child-theme-storytelling - v0.12;kraenkvisuell/nova-cms-media - no_fix;kraenkvisuell/nova-cms-media - v1.0.3;kraenkvisuell/nova-cms-media - v1.2.2;acquia/acquia_cms - 2020-10-11;acquia/acquia_cms - 2020-11-05;acquia/acquia_cms - 2020-11-17;miljoen/nova-autofill - v1.0.0;miljoen/nova-autofill - no_fix;assimp - no_fix;oburatongoi/productivity - 0.0.1;oburatongoi/productivity - no_fix;oburatongoi/productivity - 0.0.13;OctoWeb01 - no_fix;kayrules/solatjakim-api-site - dev-version-1.0;trezebits/trezevel-gallery - no_fix;narirock/marrs-catalog - no_fix;archambaultalex/image-field - no_fix;pwptemplatepusintek - no_fix;GR.PageRender.Razor - 1.8.0;angellco/spoon - 3.2.5;mmi/mmi-cms - 2.3.1;seidemann-web/wave-theme - dev-fixUpLanguageConstants;seidemann-web/wave-theme - dev-omage-theme;seidemann-web/wave-theme - dev-WT-36/Sticky-Header-Fixes;seidemann-web/wave-theme - no_fix;doublesecretagency/craft-spoon - 3.2.5;files.com/files-php-sdk - v1.0.7;oxid-esales/wave-theme - dev-oxscript-google-analytics;cloudscribe.templates - 5.2.0;ViewPacker - 1.0.18;islandora/islandora_starter_theme - dev-bd-d9-update;islandora/islandora_starter_theme - dev-don_patch;islandora/islandora_starter_theme - dev-main;flexxia/flexprimeng - dev-dependabot/npm_and_yarn/css/postcss/y18n-3.2.2;flexxia/flexprimeng - dev-update-angularjs;stephane888/generate_style_theme - 1.0.1;PWPTemplateCMS - no_fix;Fable.Template.Elmish.React - 0.1.6;node-sass-bundle - no_fix;MIDIator.WebClient - 1.0.105;i-saad-salman/statamic-analytics - no_fix;rjzaar/opencourse - dev-julprod;rjzaar/opencourse - no_fix;tombeachell/forza-magento - no_fix;ilhanet/erpnet-widget-resource - no_fix;OctoWeb - no_fix;basic-builder/easybuilder-bundle - v0.0.3;anupsathya/umd_bootstrap_sass - no_fix;platformatory/opendevx - no_fix;dnaklik/dna-exchange-bundle - no_fix;vesperphp/project - no_fix;zymawy/ironside-core - dev-utils;gheb/nn - dev-master;node-sass - no_fix;node-sass - no_fix;org.webjars.npm:node-sass:no_fix;org.webjars.npm:bourbon-neat:2.1.0
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | HIGH |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | LOW |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | MEDIUM |
| Authentication (AU): | NONE |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | PARTIAL |
| Additional information: |