PT-2022-10235 · Mjs · Mjs

Clingto · Published 2022-07-26 · Updated 2022-07-28 · CVE-2021-33439

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mjs (affected versions not specified)

Description An issue was discovered in mjs, a Restricted JavaScript engine, specifically in ES6 (JavaScript version 6), where there is an integer overflow in the gc compact strings() function in mjs.c.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

NULL Pointer Dereference

Weakness Enumeration

CWE-190

CWE-476

Related Identifiers

CVE-2021-33439

Affected Products

Mjs

References · 5

• 🔥 https://github.com/cesanta/mjs/issues/159 · Exploit
• https://osv.dev/vulnerability/CVE-2021-33439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33439 · Security Note
• https://t.me/cvenotify/33776 · Telegram Post
• https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d · Note