Quick answers
- Is CVE-2016-10141 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-10141 being exploited in the wild.
- How severe is CVE-2016-10141?
- Critical severity, with a CVSS score of 9.8, published 13 January 2017.
- Which products and versions are affected?
- Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045.
- Is there a fix for CVE-2016-10141?
- A patch was published on 2017-01-12: Fixed in commit fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-10141 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-10141?
- Check whether you run Artifex Mujs. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow vulnerability exists in the regemit function within regexp.c of Artifex MuJS. The flaw is triggered when the engine processes a regular expression containing deeply nested repetitions, which causes an overflow during the calculation of the required program size. This overflow subsequently leads to a heap-based buffer overflow when the engine attempts to write instructions into an undersized buffer. An attacker can exploit this by providing a malicious JavaScript file or regular expression string, potentially achieving arbitrary code execution or causing a denial of service (crash). The issue was addressed by implementing a maximum program size limit in commit fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045.
Affected products
- Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045
Timeline
- 2016-12-20: disclosed: Vulnerability reported to Ghostscript bug tracker
- 2017-01-12: patched: Fixed in commit fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045
- 2017-01-13: advisory: NVD publication date