Executive brief
MuJS is a lightweight JavaScript interpreter used in various applications to execute scripts. A vulnerability was found where providing a specially crafted script ending with a specific character (an asterisk) can cause the software to crash. This could allow an attacker to disrupt services or applications that rely on MuJS to process untrusted input.
Technical details
An out-of-bounds read (CWE-125) exists in the MuJS JavaScript engine within the `chartorune` function (located in `utf.c`). The root cause is in the lexical analyzer's `lexcomment` function, which fails to properly validate bounds when encountering a '*' character at the end of a multi-line comment. If the input ends abruptly with an asterisk, the engine unconditionally attempts to read the next character, leading to a 1-byte heap-buffer-overflow read. This can be triggered by providing a malicious JavaScript file or string to the interpreter, resulting in a crash (Denial of Service). The issue was addressed in commit f8234d830e17fc5e8fe09eb76d86dad3f6233c59.
Affected products
- Artifex Software MuJS unspecified
Timeline
- 2016-09-20: disclosed: Vulnerability reported by Shi Ji (@Puzzor)
- 2016-09-20: patched: Fixed in commit f8234d830e17fc5e8fe09eb76d86dad3f6233c59
- 2017-01-18: advisory: NVD publication date