[USN-6958-1] Libcroco vulnerabilities

[Allen Huang]

==========================================================================
Ubuntu Security Notice USN-6958-1
August 13, 2024

libcroco vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Libcroco.

Software Description:
- libcroco: Cascading Style Sheet (CSS) parsing and manipulation toolkit

Details:

It was discovered that Libcroco was incorrectly accessing data structures
when reading bytes from memory, which could cause a heap buffer overflow.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8
values when processing CSS files. An attacker could possibly use this
issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion in
one of its parsing functions, which could cause an infinite recursion
loop and a stack overflow due to stack consumption. An attacker could
possibly use this issue to cause a denial of service. (CVE-2020-12825)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
   libcroco-tools                  0.6.13-1ubuntu0.1
   libcroco3                       0.6.13-1ubuntu0.1

Ubuntu 18.04 LTS
   libcroco-tools                  0.6.12-2ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   libcroco3                       0.6.12-2ubuntu0.1~esm1
                                   Available with Ubuntu Pro

Ubuntu 14.04 LTS
   libcroco-tools                  0.6.8-2ubuntu1+esm1
                                   Available with Ubuntu Pro
   libcroco3                       0.6.8-2ubuntu1+esm1
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6958-1
   CVE-2017-7960, CVE-2017-8834, CVE-2017-8871, CVE-2020-12825

Package Information:
   https://launchpad.net/ubuntu/+source/libcroco/0.6.13-1ubuntu0.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20240813/0f8c74ae/attachment.sig>