Executive brief
MuJS, a lightweight JavaScript interpreter used in various applications, is vulnerable to a flaw that can cause the software to crash. By providing specially crafted JavaScript code containing incomplete escape sequences, an attacker can trigger a memory error that shuts down the service. This can lead to a denial-of-service condition, impacting the availability of applications that rely on this engine.
Technical details
An out-of-bounds (OOB) read vulnerability exists in MuJS within the `jsU_chartorune` function in `utf.c`. The issue stems from an incomplete fix for a previous vulnerability (CVE-2016-7563), where the lexer incorrectly handles multi-line comments or strings ending with specific characters like '*' or incomplete escape sequences. When the lexer encounters these sequences at the end of the input buffer, it may unconditionally attempt to read the next character, leading to a heap-buffer-overflow read. An unauthenticated remote attacker can exploit this by providing malicious JavaScript input, resulting in an application crash (Denial of Service). The vulnerability was addressed in commit a0ceaf5050faf419401fe1b83acfa950ec8a8a89.
Affected products
- Artifex Software MuJS before commit a0ceaf5050faf419401fe1b83acfa950ec8a8a89
Timeline
- 2016-09-20: disclosed: Initial discovery by Shi Ji
- 2016-10-30: disclosed: Reported as an incomplete fix for CVE-2016-7563
- 2016-11-07: patched: Fix identified in MuJS git repository
- 2017-01-18: advisory: NVD publication date