[Secure-testing-team] Bug#870186: libsass: CVE-2017-11608

[Salvatore Bonaccorso]

Source: libsass
Version: 3.4.3-1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for libsass.

CVE-2017-11608[0]:
| There is a heap-based buffer over-read in the
| Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A
| crafted input will lead to a remote denial of service attack.

Can you please double-check this report and possibly report it
upstream.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11608
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11608
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1474276

Regards,
Salvatore