Executive brief
MuJS is a lightweight JavaScript interpreter used in various applications to execute scripts. A vulnerability in its regular expression engine allows an attacker to crash the application or potentially execute unauthorized code by providing a specially crafted script. This could lead to a complete system compromise or a disruption of services that rely on the MuJS library.
Technical details
An integer overflow vulnerability exists in the regemit function within regexp.c of Artifex MuJS. The flaw is triggered when the engine processes a regular expression containing deeply nested repetitions, which causes an overflow during the calculation of the required program size. This overflow subsequently leads to a heap-based buffer overflow when the engine attempts to write instructions into an undersized buffer. An attacker can exploit this by providing a malicious JavaScript file or regular expression string, potentially achieving arbitrary code execution or causing a denial of service (crash). The issue was addressed by implementing a maximum program size limit in commit fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045.
Affected products
- Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045
Timeline
- 2016-12-20: disclosed: Vulnerability reported to Ghostscript bug tracker
- 2017-01-12: patched: Fixed in commit fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045
- 2017-01-13: advisory: NVD publication date