CVE-2017-8834

La función cr_tknzr_parse_comment en el archivo cr-tknzr.c en libcroco versión 0.6.12 permite a los atacantes remotos causar una denegación de servicio (error de asignación de memoria) por medio de un archivo CSS creado.

It was discovered that Libcroco was incorrectly accessing data structures when reading bytes from memory, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service. It was discovered that Libcroco was incorrectly handling invalid UTF-8 values when processing CSS files. An attacker could possibly use this issue to cause a denial of service.