[USN-6958-1] Libcroco vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEhC9y9XdAFQPCvYXchGmXSGiknnUFAma7gJwFAwAAAAAACgkQhGmXSGiknnW7
hw//ViFXeYzmjLJtR/CmDqYDYGqLjnjAqZKwv1nc0uG5yzIZzEOZCfE9h0sWuMwC+t5nlPX0pLbE
5qj7XZVw9x5VZ+GPyDynfteCJDTYqCRQ4ZEpjB944ncSWn4FqeUmGegb724sWGpbtepCPAs+CTpC
jl77cUfj0e/k4kDXCauUn8uUHC+8yJLoFdg7KOIGeQbeugndQM4ayikAP/P4o2DN6VWN0muk/Sut
e/jrLuPv3fFIKC7P6DLfh89SmZqUMV8puvpgM0pq1P0xSlH85jCoj0ArDlHWyCBElLIuIr35x77k
xvqL6bcMhVdkSlrJY/7OVZ4wlIAZXaesKJZTCE1nq7SH1OpZSE+Mme6Ht7CdRb54Aw+QA7V7NaE8
iPir6dK9F5XcT54popr3NZpMOj4BuFzDun/2/9lXxNZX6UczykadExPxXjrsQUH36CC+VAJuBIwq
WFo0DYC5t3AggKusSEvxAcpA9tykDYqcMAcaizkNl9gCcfV8ohp33Kyv1Xsqxsgwt1XOXeGYgdqM
xztVle1JXmfgHeixFELn5xlOC0bt58j53Vd5lCgFq1cENIVV18rEKBf1I+ybi50h3PlZMyzZydRN
/XJhc1CKTY8EJcm7SwRyClIxJcHC+bpkD9VvIzTwvDjwqMiLIMpxxtpfvYbEyo0BqRn8WocBeiFH
hbE=
=kQq0
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6958-1
August 13, 2024

libcroco vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Libcroco.

Software Description:
- libcroco: Cascading Style Sheet (CSS) parsing and manipulation toolkit

Details:

It was discovered that Libcroco was incorrectly accessing data structures
when reading bytes from memory, which could cause a heap buffer overflow.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8
values when processing CSS files. An attacker could possibly use this
issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion in
one of its parsing functions, which could cause an infinite recursion
loop and a stack overflow due to stack consumption. An attacker could
possibly use this issue to cause a denial of service. (CVE-2020-12825)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
libcroco-tools 0.6.13-1ubuntu0.1
libcroco3 0.6.13-1ubuntu0.1

Ubuntu 18.04 LTS
libcroco-tools 0.6.12-2ubuntu0.1~esm1
Available with Ubuntu Pro
libcroco3 0.6.12-2ubuntu0.1~esm1
Available with Ubuntu Pro

Ubuntu 14.04 LTS
libcroco-tools 0.6.8-2ubuntu1+esm1
Available with Ubuntu Pro
libcroco3 0.6.8-2ubuntu1+esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6958-1
CVE-2017-7960, CVE-2017-8834, CVE-2017-8871, CVE-2020-12825

Package Information:
https://launchpad.net/ubuntu/+source/libcroco/0.6.13-1ubuntu0.1