CVE-2017-5627
HighSummary
An issue was discovered in MuJS before version 4006739a28367c708dea19aeb19b8a1a9326ce08 related to the lack of a check for array length in the jsR_setproperty function. This leads to an integer overflow in the js_pushstring function when parsing a specially crafted JS file.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially leading to serious security implications for applications using MuJS.
Recommendation
It is recommended to update MuJS to the latest version to mitigate this vulnerability and to implement additional checks for array length in the code.
Other vulnerabilities in MuJS
See all- CVE-2016-10132High
The MuJS library from Artifex Software, Inc. has a vulnerability that allows attackers to cause a system crash via NULL pointer dereference during regular expression compilation.
- CVE-2016-9108High
Integer overflow in the js_regcomp function in regexp.c in MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers to cause a denial of service (application crash) via a crafted regular expression.
- CVE-2017-5628High
An issue was discovered in MuJS before version 8f62ea10a0af68e56d5c00720523ebcba13c2e6a related to the MakeDay function in jsdate.c, which does not validate the month. This leads to an integer overflow when parsing a specially crafted JS file.
- CVE-2016-9109High
MuJS by Artifex Software allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. This vulnerability exists due to an incomplete fix for CVE-2016-7563.
- CVE-2016-7563High
The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input.
- CVE-2016-9136High
MuJS before version a0ceaf5050faf419401fe1b83acfa950ec8a8a89 by Artifex Software, Inc. allows context-dependent attackers to obtain sensitive information by using a crafted JavaScript approach, related to a 'Buffer Over-read' issue.
- CVE-2016-7506High
An out-of-bounds read vulnerability was observed in the Sp_replace_regexp function of Artifex Software, Inc. MuJS before version 5000749f5afe3b956fc916e407309de840997f4a. Successful exploitation of this issue can lead to code execution or denial of service condition.
- CVE-2016-10133Critical
CVE-2016-10133 involves a heap-based buffer overflow in the js_stackoverflow function in jsrun.c in MuJS. Attackers can exploit an error when dropping extra arguments to lightweight functions, leading to unspecified impact.
- CVE-2016-7505Critical
A buffer overflow vulnerability was observed in the divby function of MuJS before version 8c805b4eb19cf2af689c860b77e6111d2ee439d5. Successful exploitation of this issue can lead to code execution or denial of service condition.
- CVE-2016-7504Critical
A use-after-free vulnerability was observed in the Rp_toString function of MuJS before version 5c337af4b3df80cf967e4f9f6a21522de84b392a. Successful exploitation can lead to code execution or denial of service condition.
Original NVD description (English source)
An issue was discovered in Artifex Software, Inc. MuJS before 4006739a28367c708dea19aeb19b8a1a9326ce08. The jsR_setproperty function in jsrun.c lacks a check for a negative array length. This leads to an integer overflow in the js_pushstring function in jsrun.c when parsing a specially crafted JS file.