MuJS vulnerabilities

The MuJS library from Artifex Software, Inc. has a vulnerability that allows attackers to cause a system crash via NULL pointer dereference during regular expression compilation.

Integer overflow in the js_regcomp function in regexp.c in MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers to cause a denial of service (application crash) via a crafted regular expression.

An issue was discovered in MuJS before version 8f62ea10a0af68e56d5c00720523ebcba13c2e6a related to the MakeDay function in jsdate.c, which does not validate the month. This leads to an integer overflow when parsing a specially crafted JS file.

An issue was discovered in MuJS before version 4006739a28367c708dea19aeb19b8a1a9326ce08 related to the lack of a check for array length in the jsR_setproperty function. This leads to an integer overflow in the js_pushstring function when parsing a specially crafted JS file.

MuJS by Artifex Software allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. This vulnerability exists due to an incomplete fix for CVE-2016-7563.

The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input.

MuJS before version a0ceaf5050faf419401fe1b83acfa950ec8a8a89 by Artifex Software, Inc. allows context-dependent attackers to obtain sensitive information by using a crafted JavaScript approach, related to a 'Buffer Over-read' issue.

An out-of-bounds read vulnerability was observed in the Sp_replace_regexp function of Artifex Software, Inc. MuJS before version 5000749f5afe3b956fc916e407309de840997f4a. Successful exploitation of this issue can lead to code execution or denial of service condition.

CVE-2016-10133 involves a heap-based buffer overflow in the js_stackoverflow function in jsrun.c in MuJS. Attackers can exploit an error when dropping extra arguments to lightweight functions, leading to unspecified impact.

A buffer overflow vulnerability was observed in the divby function of MuJS before version 8c805b4eb19cf2af689c860b77e6111d2ee439d5. Successful exploitation of this issue can lead to code execution or denial of service condition.

A use-after-free vulnerability was observed in the Rp_toString function of MuJS before version 5c337af4b3df80cf967e4f9f6a21522de84b392a. Successful exploitation can lead to code execution or denial of service condition.

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation.