CVE-2016-10141
published 2017-01-13CVE-2016-10141: An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before…
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.65%
89.5th percentile
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045. The attack requires a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | mujs | < 2017-01-12 | 2017-01-12 |
| debian | mujs | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_debian9.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6j4g-3pfp-hgj5: An integer overflow vulnerability was observed in the regemit function in regexp
ghsa_unreviewed·2022-05-13
CVE-2016-10141 [CRITICAL] CWE-190 GHSA-6j4g-3pfp-hgj5: An integer overflow vulnerability was observed in the regemit function in regexp
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045. The attack requires a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition.
Debian
CVE-2016-10141: mujs - An integer overflow vulnerability was observed in the regemit function in regexp...
vendor_debian·2016·CVSS 9.8
CVE-2016-10141 [CRITICAL] CVE-2016-10141: mujs - An integer overflow vulnerability was observed in the regemit function in regexp...
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045. The attack requires a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues [fedora-all]
bugzilla·2017-01-13·CVSS 7.5
CVE-2016-10132 [HIGH] CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues [fedora-all]
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues
bugzilla·2017-01-13·CVSS 7.5
CVE-2016-10132 [HIGH] CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues
Two security issues received CVEs on oss-security.
1. Null pointer dereference in regexp.c - CVE-2016-10132
The return value from malloc is not properly checked before dereferencing it which can result in a crash.
https://bugs.ghostscript.com/show_bug.cgi?id=697381
http://git.ghostscript.com/?p=mujs.git;h=fd003eceda531e13fbdd1aeb6e9c73156496e569
2. Heap buffer overflow write in jsrun.c: js_stackoverflow() - CVE-2016-10133
There was a logical error in the code which can be used to trigger a heap overflow write.
https://bugs.ghostscript.com/show_bug.cgi?id=697401
http://git.ghostscript.com/?p=mujs.git;a=commit;h=77ab465f1c394bb77f00966cd950650f3f53cb24
Discussion:
Created mujs tra
http://git.ghostscript.com/?p=mujs.git%3Bh=fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045http://www.securityfocus.com/bid/95876https://bugs.ghostscript.com/show_bug.cgi?id=697448http://git.ghostscript.com/?p=mujs.git%3Bh=fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045http://www.securityfocus.com/bid/95876https://bugs.ghostscript.com/show_bug.cgi?id=697448
2017-01-13
Published