vendor:
Mujs
by:
Andrea Sindoni
5.5
CVSS
MEDIUM
Integer Overflow
190
CWE
Product Name: Mujs
Affected Version From: Mujs - 228719d087aa5e27dcd8627c4acf7273476bdbca
Affected Version To: Mujs - 228719d087aa5e27dcd8627c4acf7273476bdbca
Patch Exists: YES
Related CWE: CVE-2018-6191
CPE: a:artifex:mujs
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Linux
2018
Integer signedness error leading to Out-of-bounds read that causes crash
The js_strtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an integer overflow because of incorrect exponent validation. Inside the function js_strtod, after the line exp = -exp; the value of 'exp' is still negative (cause integer declaration).
Mitigation:
Fixed in commit 25821e6d74fab5fcc200fe5e818362e03e114428
