CVE-2017-7960: Gnome Libcroco

Medium severity, CVSS 5.5. EPSS: 2% chance of exploitation in the next 30 days.

The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.

Affected products

• Gnome Libcroco: version 0.6.11 only; version 0.6.12 only

Published 2017-04-19. Last modified 2026-06-17.