Vulnerability from csaf_opensuse
Published
2019-08-14 10:51
Modified
2019-08-14 10:51
Summary
Security update for libsass

Notes

Title of the patch
Security update for libsass
Description of the patch
This update for libsass to version 3.6.1 fixes the following issues: Security issues fixed: - CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943). - CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944). - CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945). - CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894). - CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301). - CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346). - CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348). - CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349). - CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351). - CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789). - CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200). - CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201). This update was imported from the openSUSE:Leap:15.0:Update update project.
Patchnames
openSUSE-2019-1883
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for libsass",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for libsass to version 3.6.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943).\n- CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944).\n- CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945).\n- CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894).\n- CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301).\n- CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346).\n- CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348).\n- CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349).\n- CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351).\n- CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789).\n- CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200).\n- CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-2019-1883",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1883-1.json",
         },
         {
            category: "self",
            summary: "URL for openSUSE-SU-2019:1883-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6/#HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6",
         },
         {
            category: "self",
            summary: "E-Mail link for openSUSE-SU-2019:1883-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6/#HPU3GRLOX4PSKM4UBZP2UQ5JATS5U6U6",
         },
         {
            category: "self",
            summary: "SUSE Bug 1096894",
            url: "https://bugzilla.suse.com/1096894",
         },
         {
            category: "self",
            summary: "SUSE Bug 1118301",
            url: "https://bugzilla.suse.com/1118301",
         },
         {
            category: "self",
            summary: "SUSE Bug 1118346",
            url: "https://bugzilla.suse.com/1118346",
         },
         {
            category: "self",
            summary: "SUSE Bug 1118348",
            url: "https://bugzilla.suse.com/1118348",
         },
         {
            category: "self",
            summary: "SUSE Bug 1118349",
            url: "https://bugzilla.suse.com/1118349",
         },
         {
            category: "self",
            summary: "SUSE Bug 1118351",
            url: "https://bugzilla.suse.com/1118351",
         },
         {
            category: "self",
            summary: "SUSE Bug 1119789",
            url: "https://bugzilla.suse.com/1119789",
         },
         {
            category: "self",
            summary: "SUSE Bug 1121943",
            url: "https://bugzilla.suse.com/1121943",
         },
         {
            category: "self",
            summary: "SUSE Bug 1121944",
            url: "https://bugzilla.suse.com/1121944",
         },
         {
            category: "self",
            summary: "SUSE Bug 1121945",
            url: "https://bugzilla.suse.com/1121945",
         },
         {
            category: "self",
            summary: "SUSE Bug 1133200",
            url: "https://bugzilla.suse.com/1133200",
         },
         {
            category: "self",
            summary: "SUSE Bug 1133201",
            url: "https://bugzilla.suse.com/1133201",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-11499 page",
            url: "https://www.suse.com/security/cve/CVE-2018-11499/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-19797 page",
            url: "https://www.suse.com/security/cve/CVE-2018-19797/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-19827 page",
            url: "https://www.suse.com/security/cve/CVE-2018-19827/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-19837 page",
            url: "https://www.suse.com/security/cve/CVE-2018-19837/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-19838 page",
            url: "https://www.suse.com/security/cve/CVE-2018-19838/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-19839 page",
            url: "https://www.suse.com/security/cve/CVE-2018-19839/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-20190 page",
            url: "https://www.suse.com/security/cve/CVE-2018-20190/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-20821 page",
            url: "https://www.suse.com/security/cve/CVE-2018-20821/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-20822 page",
            url: "https://www.suse.com/security/cve/CVE-2018-20822/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-6283 page",
            url: "https://www.suse.com/security/cve/CVE-2019-6283/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-6284 page",
            url: "https://www.suse.com/security/cve/CVE-2019-6284/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-6286 page",
            url: "https://www.suse.com/security/cve/CVE-2019-6286/",
         },
      ],
      title: "Security update for libsass",
      tracking: {
         current_release_date: "2019-08-14T10:51:26Z",
         generator: {
            date: "2019-08-14T10:51:26Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2019:1883-1",
         initial_release_date: "2019-08-14T10:51:26Z",
         revision_history: [
            {
               date: "2019-08-14T10:51:26Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                        product: {
                           name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                           product_id: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                        product: {
                           name: "libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                           product_id: "libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                        product: {
                           name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                           product_id: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                        product: {
                           name: "libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                           product_id: "libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                        product: {
                           name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                           product_id: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libsass-devel-3.6.1-bp151.4.3.1.s390x",
                        product: {
                           name: "libsass-devel-3.6.1-bp151.4.3.1.s390x",
                           product_id: "libsass-devel-3.6.1-bp151.4.3.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                        product: {
                           name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                           product_id: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libsass-devel-3.6.1-bp151.4.3.1.x86_64",
                        product: {
                           name: "libsass-devel-3.6.1-bp151.4.3.1.x86_64",
                           product_id: "libsass-devel-3.6.1-bp151.4.3.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Package Hub 15 SP1",
                        product: {
                           name: "SUSE Package Hub 15 SP1",
                           product_id: "SUSE Package Hub 15 SP1",
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
            },
            product_reference: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
            },
            product_reference: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
            },
            product_reference: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
            },
            product_reference: "libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-devel-3.6.1-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
            },
            product_reference: "libsass-devel-3.6.1-bp151.4.3.1.aarch64",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-devel-3.6.1-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
            },
            product_reference: "libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-devel-3.6.1-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
            },
            product_reference: "libsass-devel-3.6.1-bp151.4.3.1.s390x",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libsass-devel-3.6.1-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1",
               product_id: "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            },
            product_reference: "libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            relates_to_product_reference: "SUSE Package Hub 15 SP1",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-11499",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-11499",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-11499",
               url: "https://www.suse.com/security/cve/CVE-2018-11499",
            },
            {
               category: "external",
               summary: "SUSE Bug 1096894 for CVE-2018-11499",
               url: "https://bugzilla.suse.com/1096894",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "critical",
            },
         ],
         title: "CVE-2018-11499",
      },
      {
         cve: "CVE-2018-19797",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-19797",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-19797",
               url: "https://www.suse.com/security/cve/CVE-2018-19797",
            },
            {
               category: "external",
               summary: "SUSE Bug 1118301 for CVE-2018-19797",
               url: "https://bugzilla.suse.com/1118301",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-19797",
      },
      {
         cve: "CVE-2018-19827",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-19827",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-19827",
               url: "https://www.suse.com/security/cve/CVE-2018-19827",
            },
            {
               category: "external",
               summary: "SUSE Bug 1118346 for CVE-2018-19827",
               url: "https://bugzilla.suse.com/1118346",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "important",
            },
         ],
         title: "CVE-2018-19827",
      },
      {
         cve: "CVE-2018-19837",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-19837",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-19837",
               url: "https://www.suse.com/security/cve/CVE-2018-19837",
            },
            {
               category: "external",
               summary: "SUSE Bug 1118348 for CVE-2018-19837",
               url: "https://bugzilla.suse.com/1118348",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-19837",
      },
      {
         cve: "CVE-2018-19838",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-19838",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-19838",
               url: "https://www.suse.com/security/cve/CVE-2018-19838",
            },
            {
               category: "external",
               summary: "SUSE Bug 1118349 for CVE-2018-19838",
               url: "https://bugzilla.suse.com/1118349",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-19838",
      },
      {
         cve: "CVE-2018-19839",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-19839",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-19839",
               url: "https://www.suse.com/security/cve/CVE-2018-19839",
            },
            {
               category: "external",
               summary: "SUSE Bug 1118351 for CVE-2018-19839",
               url: "https://bugzilla.suse.com/1118351",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-19839",
      },
      {
         cve: "CVE-2018-20190",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-20190",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-20190",
               url: "https://www.suse.com/security/cve/CVE-2018-20190",
            },
            {
               category: "external",
               summary: "SUSE Bug 1119789 for CVE-2018-20190",
               url: "https://bugzilla.suse.com/1119789",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-20190",
      },
      {
         cve: "CVE-2018-20821",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-20821",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-20821",
               url: "https://www.suse.com/security/cve/CVE-2018-20821",
            },
            {
               category: "external",
               summary: "SUSE Bug 1133200 for CVE-2018-20821",
               url: "https://bugzilla.suse.com/1133200",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-20821",
      },
      {
         cve: "CVE-2018-20822",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-20822",
            },
         ],
         notes: [
            {
               category: "general",
               text: "LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-20822",
               url: "https://www.suse.com/security/cve/CVE-2018-20822",
            },
            {
               category: "external",
               summary: "SUSE Bug 1133201 for CVE-2018-20822",
               url: "https://bugzilla.suse.com/1133201",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-20822",
      },
      {
         cve: "CVE-2019-6283",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-6283",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-6283",
               url: "https://www.suse.com/security/cve/CVE-2019-6283",
            },
            {
               category: "external",
               summary: "SUSE Bug 1121943 for CVE-2019-6283",
               url: "https://bugzilla.suse.com/1121943",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-6283",
      },
      {
         cve: "CVE-2019-6284",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-6284",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-6284",
               url: "https://www.suse.com/security/cve/CVE-2019-6284",
            },
            {
               category: "external",
               summary: "SUSE Bug 1121944 for CVE-2019-6284",
               url: "https://bugzilla.suse.com/1121944",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-6284",
      },
      {
         cve: "CVE-2019-6286",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-6286",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
               "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-6286",
               url: "https://www.suse.com/security/cve/CVE-2019-6286",
            },
            {
               category: "external",
               summary: "SUSE Bug 1121945 for CVE-2019-6286",
               url: "https://bugzilla.suse.com/1121945",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-3_6_1-1-3.6.1-bp151.4.3.1.x86_64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.aarch64",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.ppc64le",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.s390x",
                  "SUSE Package Hub 15 SP1:libsass-devel-3.6.1-bp151.4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2019-08-14T10:51:26Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-6286",
      },
   ],
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.