CVE-2018-11698: High severity libsass vulnerability
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handleerror which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Other sources
LibSaas could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read of a memory region in the function Sass::handleerror. By using a specially-crafted file, a remote attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-11698?
CVE-2018-11698 is a vulnerability discovered in LibSass version 3.5.4 that allows an attacker to perform an out-of-bounds read of a memory region, potentially leading to information disclosure or denial of service.
What is the severity of CVE-2018-11698?
The severity of CVE-2018-11698 is high, with a CVSSv3 score of 8.1.
How does CVE-2018-11698 affect LibSass?
CVE-2018-11698 affects LibSass versions up to and including 3.5.4, allowing an attacker to exploit an out-of-bounds read vulnerability in the function Sass::handle_error.
What can an attacker do with CVE-2018-11698?
An attacker can leverage CVE-2018-11698 to disclose sensitive information or cause a denial of service by manipulating the out-of-bounds read to read from unmapped memory.
Is there a fix for CVE-2018-11698?
Yes, updating to a version of LibSass that is beyond 3.5.4 will address the vulnerability in CVE-2018-11698.