CVE-2017-5628
published 2017-01-30CVE-2017-5628: An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the…
PriorityP434high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.03%
63.6th percentile
An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | mujs | < 2017-01-24 | 2017-01-24 |
| debian | mujs | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_debian7.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Artifex MuJS prior 8f62ea10a0af68e56d5c00720523ebcba13c2e6a jsdate.c MakeDay integer overflow (FEDORA-2017-624e2eeda0 / Nessus ID 97338)
vuldb·2026-05-17·CVSS 7.8
CVE-2017-5628 [HIGH] Artifex MuJS prior 8f62ea10a0af68e56d5c00720523ebcba13c2e6a jsdate.c MakeDay integer overflow (FEDORA-2017-624e2eeda0 / Nessus ID 97338)
A vulnerability classified as critical was found in Artifex MuJS 1.0.5/1.1.3/5c337af4b3df80cf967e4f9f6a21522de84b392a/8c805b4eb19cf2af689c860b77e6111d2ee439d5. The affected element is the function MakeDay of the file jsdate.c. Such manipulation leads to integer overflow.
This vulnerability is listed as CVE-2017-5628. The attack must be carried out locally. There is no available exploit.
Upgrading the affected component is advised.
GHSA
GHSA-3v2p-pv62-pg94: An issue was discovered in Artifex Software, Inc
ghsa_unreviewed·2022-05-13
CVE-2017-5628 [HIGH] CWE-190 GHSA-3v2p-pv62-pg94: An issue was discovered in Artifex Software, Inc
An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file.
Debian
CVE-2017-5628: mujs - An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d...
vendor_debian·2017·CVSS 7.8
CVE-2017-5628 [HIGH] CVE-2017-5628: mujs - An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d...
An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues [fedora-all]
bugzilla·2017-01-13·CVSS 7.5
CVE-2016-10132 [HIGH] CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues [fedora-all]
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues
bugzilla·2017-01-13·CVSS 7.5
CVE-2016-10132 [HIGH] CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues
CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 CVE-2017-5627 CVE-2017-5628 mujs: Multiple security issues
Two security issues received CVEs on oss-security.
1. Null pointer dereference in regexp.c - CVE-2016-10132
The return value from malloc is not properly checked before dereferencing it which can result in a crash.
https://bugs.ghostscript.com/show_bug.cgi?id=697381
http://git.ghostscript.com/?p=mujs.git;h=fd003eceda531e13fbdd1aeb6e9c73156496e569
2. Heap buffer overflow write in jsrun.c: js_stackoverflow() - CVE-2016-10133
There was a logical error in the code which can be used to trigger a heap overflow write.
https://bugs.ghostscript.com/show_bug.cgi?id=697401
http://git.ghostscript.com/?p=mujs.git;a=commit;h=77ab465f1c394bb77f00966cd950650f3f53cb24
Discussion:
Created mujs tra
http://git.ghostscript.com/?p=mujs.git%3Bh=8f62ea10a0af68e56d5c00720523ebcba13c2e6ahttp://www.securityfocus.com/bid/95855https://bugs.ghostscript.com/show_bug.cgi?id=697496http://git.ghostscript.com/?p=mujs.git%3Bh=8f62ea10a0af68e56d5c00720523ebcba13c2e6ahttp://www.securityfocus.com/bid/95855https://bugs.ghostscript.com/show_bug.cgi?id=697496
2017-01-30
Published