Artifex Software Artifex MuJS Resource Management Error Vulnerability

Artifex Software Artifex MuJS is a lightweight JavaScript interpreter from Artifex Software that is used to embed into other software to provide script execution capabilities. A resource management error vulnerability exists in the jsrun.c file in Artifex Software Artifex MuJS 1.0.7 and earlier...

CVE-2020-24343

Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c...

CVE-2020-24343

CVE-2020-24343 affects Artifex MuJS up to version 1.0.7, where a use-after-free occurs in jsrun.c due to unconditional marking in jsgc.c. The issue arises from resource management in the MuJS JavaScript engine’s garbage collector, enabling a dangerous use-after-free condition. Connected sources c...

CVE-2016-10133

Heap-based buffer overflow in the jsstackoverflow function in jsrun.c in Artifex Software, Inc. MuJS allows attackers to have unspecified impact by leveraging an error when dropping extra arguments to lightweight functions...

CVE-2016-10133

Heap-based buffer overflow in the jsstackoverflow function in jsrun.c in Artifex Software, Inc. MuJS allows attackers to have unspecified impact by leveraging an error when dropping extra arguments to lightweight functions...

Integer overflow

An issue was discovered in Artifex Software, Inc. MuJS before 4006739a28367c708dea19aeb19b8a1a9326ce08. The jsRsetproperty function in jsrun.c lacks a check for a negative array length. This leads to an integer overflow in the jspushstring function in jsrun.c when parsing a specially crafted JS...

CVE-2017-5627

An issue was discovered in Artifex Software, Inc. MuJS before 4006739a28367c708dea19aeb19b8a1a9326ce08. The jsRsetproperty function in jsrun.c lacks a check for a negative array length. This leads to an integer overflow in the jspushstring function in jsrun.c when parsing a specially crafted JS...

CVE-2017-5627

An issue was discovered in Artifex Software, Inc. MuJS before 4006739a28367c708dea19aeb19b8a1a9326ce08. The jsRsetproperty function in jsrun.c lacks a check for a negative array length. This leads to an integer overflow in the jspushstring function in jsrun.c when parsing a specially crafted JS...