Executive brief
MuJS is a lightweight JavaScript interpreter often embedded in other software to provide scripting capabilities. A vulnerability in how it handles function names and parameters can allow an attacker to crash the application by providing specially crafted input. This results in a denial of service, potentially disrupting operations or services that rely on the MuJS engine.
Technical details
A heap-based buffer overflow exists in the Fp_toString function within jsfunction.c of the MuJS library. The vulnerability is caused by an off-by-one error where the code fails to allocate sufficient memory for the terminating null byte when calculating the string length for a function's representation. An attacker can trigger this overflow by providing crafted input that populates function names or parameters in a specific way, leading to a memory corruption (WRITE of size 1) and a subsequent crash. The issue was fixed in commit a3a4fe840b80706c706e86160352af5936f292d8.
Affected products
- Artifex Software MuJS versions prior to commit a3a4fe8
Timeline
- 2016-09-20: disclosed: Vulnerability discovered and reported by Shi Ji
- 2016-09-20: patched: Fixed in MuJS source repository
- 2017-01-18: advisory: NVD publication date