Is CVE-2016-9109 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9109 being exploited in the wild.

How severe is CVE-2016-9109?

High severity, with a CVSS score of 7.5, published 18 January 2017.

Which products and versions are affected?

Artifex Software MuJS before commit a0ceaf5050faf419401fe1b83acfa950ec8a8a89.

Is there a fix for CVE-2016-9109?

A patch was published on 2016-11-07: Fix identified in MuJS git repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-9109 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-9109?

Check whether you run Artifex Mujs. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9109: Artifex Software MuJS out-of-bounds read in chartorune

CVE-2016-9109 · Severity: high · CVSS 7.5 · Published 2017-01-18

MuJS, a lightweight JavaScript interpreter used in various applications, is vulnerable to a flaw that can cause the software to crash. By providing specially crafted JavaScript code containing incomplete escape sequences, an attacker can trigger a memory error that shuts down the service. This can lead to a denial-of-service condition, impacting the availability of applications that rely on this engine.

Technologies: Artifex Mujs. Vendors: Artifex.

Quick answers

Is CVE-2016-9109 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9109 being exploited in the wild.
How severe is CVE-2016-9109?: High severity, with a CVSS score of 7.5, published 18 January 2017.
Which products and versions are affected?: Artifex Software MuJS before commit a0ceaf5050faf419401fe1b83acfa950ec8a8a89.
Is there a fix for CVE-2016-9109?: A patch was published on 2016-11-07: Fix identified in MuJS git repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9109 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-9109?: Check whether you run Artifex Mujs. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) read vulnerability exists in MuJS within the `jsU_chartorune` function in `utf.c`. The issue stems from an incomplete fix for a previous vulnerability (CVE-2016-7563), where the lexer incorrectly handles multi-line comments or strings ending with specific characters like '*' or incomplete escape sequences. When the lexer encounters these sequences at the end of the input buffer, it may unconditionally attempt to read the next character, leading to a heap-buffer-overflow read. An unauthenticated remote attacker can exploit this by providing malicious JavaScript input, resulting in an application crash (Denial of Service). The vulnerability was addressed in commit a0ceaf5050faf419401fe1b83acfa950ec8a8a89.

Affected products

Artifex Software MuJS before commit a0ceaf5050faf419401fe1b83acfa950ec8a8a89

Timeline

2016-09-20: disclosed: Initial discovery by Shi Ji
2016-10-30: disclosed: Reported as an incomplete fix for CVE-2016-7563
2016-11-07: patched: Fix identified in MuJS git repository
2017-01-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.