Executive brief
MuJS, a lightweight JavaScript interpreter used in various software applications, is vulnerable to a memory corruption issue when processing malformed JavaScript files. An attacker could provide a specially crafted script that, when executed by the interpreter, causes the application to crash or potentially allows for unauthorized data access. This could lead to a loss of service or compromise the security of the system running the software.
Technical details
An integer overflow vulnerability exists in Artifex Software MuJS before commit 4006739a28367c708dea19aeb19b8a1a9326ce08. The root cause is located in the jsR_setproperty function within jsrun.c, which fails to validate that an array length is positive. When a specially crafted JavaScript file with a negative array length is parsed, it triggers an integer overflow in the js_pushstring function. This leads to an invalid memory read (segmentation fault) during string operations like strlen. An attacker can exploit this by tricking a user or automated system into processing a malicious JS file, potentially leading to arbitrary code execution or a denial-of-service (DoS) condition. The issue was fixed by ensuring array lengths are strictly positive.
Affected products
- Artifex Software, Inc. MuJS before commit 4006739a28367c708dea19aeb19b8a1a9326ce08
Timeline
- 2017-01-23: disclosed: Bug reported to Ghostscript Bugzilla
- 2017-01-24: patched: Fixed in commit 4006739a28367c708dea19aeb19b8a1a9326ce08
- 2017-01-30: advisory: NVD publication date