GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2019:1791-1

Vulnerability from csaf_opensuse - Published: 2019-07-23 11:22 - Updated: 2019-07-23 11:22
Summary
Security update for libsass
Severity
Moderate
Notes
Title of the patch: Security update for libsass
Description of the patch: This update for libsass to version 3.6.1 fixes the following issues: Security issues fixed: - CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943). - CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944). - CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945). - CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894). - CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301). - CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346). - CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348). - CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349). - CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351). - CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789). - CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200). - CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).
Patchnames: openSUSE-2019-1791
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2018-11499
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64 —
Vendor Fix
Threats
Impact critical
CVE-2018-19797
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2018-19827
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact important
CVE-2018-19837
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2018-19838
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2018-19839
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2018-20190
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2018-20821
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2018-20822
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2019-6283
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2019-6284
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
CVE-2019-6286
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2018-11499
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://lists.opensuse.org/archives/list/security… self
https://lists.opensuse.org/archives/list/security… self
https://bugzilla.suse.com/1096894 self
https://bugzilla.suse.com/1118301 self
https://bugzilla.suse.com/1118346 self
https://bugzilla.suse.com/1118348 self
https://bugzilla.suse.com/1118349 self
https://bugzilla.suse.com/1118351 self
https://bugzilla.suse.com/1119789 self
https://bugzilla.suse.com/1121943 self
https://bugzilla.suse.com/1121944 self
https://bugzilla.suse.com/1121945 self
https://bugzilla.suse.com/1133200 self
https://bugzilla.suse.com/1133201 self
https://www.suse.com/security/cve/CVE-2018-11499/ self
https://www.suse.com/security/cve/CVE-2018-19797/ self
https://www.suse.com/security/cve/CVE-2018-19827/ self
https://www.suse.com/security/cve/CVE-2018-19837/ self
https://www.suse.com/security/cve/CVE-2018-19838/ self
https://www.suse.com/security/cve/CVE-2018-19839/ self
https://www.suse.com/security/cve/CVE-2018-20190/ self
https://www.suse.com/security/cve/CVE-2018-20821/ self
https://www.suse.com/security/cve/CVE-2018-20822/ self
https://www.suse.com/security/cve/CVE-2019-6283/ self
https://www.suse.com/security/cve/CVE-2019-6284/ self
https://www.suse.com/security/cve/CVE-2019-6286/ self
https://www.suse.com/security/cve/CVE-2018-11499 external
https://bugzilla.suse.com/1096894 external
https://www.suse.com/security/cve/CVE-2018-19797 external
https://bugzilla.suse.com/1118301 external
https://www.suse.com/security/cve/CVE-2018-19827 external
https://bugzilla.suse.com/1118346 external
https://www.suse.com/security/cve/CVE-2018-19837 external
https://bugzilla.suse.com/1118348 external
https://www.suse.com/security/cve/CVE-2018-19838 external
https://bugzilla.suse.com/1118349 external
https://www.suse.com/security/cve/CVE-2018-19839 external
https://bugzilla.suse.com/1118351 external
https://www.suse.com/security/cve/CVE-2018-20190 external
https://bugzilla.suse.com/1119789 external
https://www.suse.com/security/cve/CVE-2018-20821 external
https://bugzilla.suse.com/1133200 external
https://www.suse.com/security/cve/CVE-2018-20822 external
https://bugzilla.suse.com/1133201 external
https://www.suse.com/security/cve/CVE-2019-6283 external
https://bugzilla.suse.com/1121943 external
https://www.suse.com/security/cve/CVE-2019-6284 external
https://bugzilla.suse.com/1121944 external
https://www.suse.com/security/cve/CVE-2019-6286 external
https://bugzilla.suse.com/1121945 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libsass",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2019-1791",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1791-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2019:1791-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME/#YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2019:1791-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME/#YJ7FECPNTPURCXIOZ6UWOJFRTA4TVLME"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1096894",
        "url": "https://bugzilla.suse.com/1096894"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1118301",
        "url": "https://bugzilla.suse.com/1118301"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1118346",
        "url": "https://bugzilla.suse.com/1118346"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1118348",
        "url": "https://bugzilla.suse.com/1118348"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1118349",
        "url": "https://bugzilla.suse.com/1118349"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1118351",
        "url": "https://bugzilla.suse.com/1118351"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1119789",
        "url": "https://bugzilla.suse.com/1119789"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1121943",
        "url": "https://bugzilla.suse.com/1121943"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1121944",
        "url": "https://bugzilla.suse.com/1121944"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1121945",
        "url": "https://bugzilla.suse.com/1121945"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1133200",
        "url": "https://bugzilla.suse.com/1133200"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1133201",
        "url": "https://bugzilla.suse.com/1133201"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-11499 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-11499/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19797 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19797/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19827 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19837 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19837/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19838 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19838/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19839 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19839/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20190 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20821 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20822 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20822/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-6283 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-6283/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-6284 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-6284/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-6286 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-6286/"
      }
    ],
    "title": "Security update for libsass",
    "tracking": {
      "current_release_date": "2019-07-23T11:22:02Z",
      "generator": {
        "date": "2019-07-23T11:22:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2019:1791-1",
      "initial_release_date": "2019-07-23T11:22:02Z",
      "revision_history": [
        {
          "date": "2019-07-23T11:22:02Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
                "product": {
                  "name": "libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
                  "product_id": "libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libsass-devel-3.6.1-lp151.3.3.1.x86_64",
                "product": {
                  "name": "libsass-devel-3.6.1-lp151.3.3.1.x86_64",
                  "product_id": "libsass-devel-3.6.1-lp151.3.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.0",
                "product": {
                  "name": "openSUSE Leap 15.0",
                  "product_id": "openSUSE Leap 15.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64 as component of openSUSE Leap 15.0",
          "product_id": "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64"
        },
        "product_reference": "libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsass-devel-3.6.1-lp151.3.3.1.x86_64 as component of openSUSE Leap 15.0",
          "product_id": "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        },
        "product_reference": "libsass-devel-3.6.1-lp151.3.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64"
        },
        "product_reference": "libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsass-devel-3.6.1-lp151.3.3.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        },
        "product_reference": "libsass-devel-3.6.1-lp151.3.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-11499",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-11499"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-11499",
          "url": "https://www.suse.com/security/cve/CVE-2018-11499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1096894 for CVE-2018-11499",
          "url": "https://bugzilla.suse.com/1096894"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2018-11499"
    },
    {
      "cve": "CVE-2018-19797",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19797"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19797",
          "url": "https://www.suse.com/security/cve/CVE-2018-19797"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118301 for CVE-2018-19797",
          "url": "https://bugzilla.suse.com/1118301"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19797"
    },
    {
      "cve": "CVE-2018-19827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19827",
          "url": "https://www.suse.com/security/cve/CVE-2018-19827"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118346 for CVE-2018-19827",
          "url": "https://bugzilla.suse.com/1118346"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-19827"
    },
    {
      "cve": "CVE-2018-19837",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19837"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of \u0027%\u0027 as a modulo operator in parser.cpp.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19837",
          "url": "https://www.suse.com/security/cve/CVE-2018-19837"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118348 for CVE-2018-19837",
          "url": "https://bugzilla.suse.com/1118348"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19837"
    },
    {
      "cve": "CVE-2018-19838",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19838"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19838",
          "url": "https://www.suse.com/security/cve/CVE-2018-19838"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118349 for CVE-2018-19838",
          "url": "https://bugzilla.suse.com/1118349"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19838"
    },
    {
      "cve": "CVE-2018-19839",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19839"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19839",
          "url": "https://www.suse.com/security/cve/CVE-2018-19839"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118351 for CVE-2018-19839",
          "url": "https://bugzilla.suse.com/1118351"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19839"
    },
    {
      "cve": "CVE-2018-20190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20190",
          "url": "https://www.suse.com/security/cve/CVE-2018-20190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1119789 for CVE-2018-20190",
          "url": "https://bugzilla.suse.com/1119789"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20190"
    },
    {
      "cve": "CVE-2018-20821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20821",
          "url": "https://www.suse.com/security/cve/CVE-2018-20821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133200 for CVE-2018-20821",
          "url": "https://bugzilla.suse.com/1133200"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20821"
    },
    {
      "cve": "CVE-2018-20822",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20822"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20822",
          "url": "https://www.suse.com/security/cve/CVE-2018-20822"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133201 for CVE-2018-20822",
          "url": "https://bugzilla.suse.com/1133201"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20822"
    },
    {
      "cve": "CVE-2019-6283",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-6283"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-6283",
          "url": "https://www.suse.com/security/cve/CVE-2019-6283"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1121943 for CVE-2019-6283",
          "url": "https://bugzilla.suse.com/1121943"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-6283"
    },
    {
      "cve": "CVE-2019-6284",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-6284"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-6284",
          "url": "https://www.suse.com/security/cve/CVE-2019-6284"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1121944 for CVE-2019-6284",
          "url": "https://bugzilla.suse.com/1121944"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-6284"
    },
    {
      "cve": "CVE-2019-6286",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-6286"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-6286",
          "url": "https://www.suse.com/security/cve/CVE-2019-6286"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1121945 for CVE-2019-6286",
          "url": "https://bugzilla.suse.com/1121945"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.0:libsass-devel-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-3_6_1-1-3.6.1-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:libsass-devel-3.6.1-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-23T11:22:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-6286"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.