Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2020-1251)

The remote host is missing an update for the Huawei EulerOS 'libcroco' package(s) announced via the EulerOS-SA-2020-1251 advisory.

** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an 'outside the range of representable values of type long' undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports 'This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components.'(CVE-2017-7961) The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.(CVE-2017-7960)

'libcroco' package(s) on Huawei EulerOS Virtualization for ARM 64 3.0.2.0.

Checks if a vulnerable package version is present on the target host.

Please install the updated package(s).