PT-2019-12298 · Artifex · Artifex Mujs

Published 2019-04-21 · Updated 2022-11-29 · CVE-2019-11413

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Artifex MuJS version 1.0.5

Description An issue was discovered in Artifex MuJS. It has unlimited recursion because the match function in regexp.c lacks a depth check.

Recommendations For Artifex MuJS version 1.0.5, consider applying a patch or modification to add a depth check to the match function in regexp.c to prevent unlimited recursion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2019-11413

Affected Products

Artifex Mujs

References · 12

• https://github.com/ccxvii/mujs/commit/00d4606c3baf813b7b1c176823b2729bf51002a2 · Patch
• http://ghostscript.com/cgi-bin/findgit.cgi?00d4606c3baf813b7b1c176823b2729bf51002a2 · Vendor Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=700937 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/67PMOZV4DLVL2KGU2SV724QL7Y4PKWKU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFCRO74ORRIVWNVAX2MAMRY3THCTWLQI · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RQXMWEOWCGLOLFBQSXBM3MBN33T4I5H · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11413 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11413 · Vendor Advisory
• https://security.gentoo.org/glsa/202007-52 · Vendor Advisory
• https://t.me/cvenotify/38631 · Telegram Post
• http://securityfocus.com/bid/108093 · Note
• https://t.me/cibsecurity/42887 · Telegram Post