CVE-2021-33797CWE-119

Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1

Critical · published April 17, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

🔥 A staggering buffer overflow in Artifex MuJS could let attackers run wild! This vulnerability lurks in versions 1.0.1 to 1.1.1, just waiting for the right input to unleash chaos. ⚡ Think of the vulnerability like a tightly packed suitcase that suddenly bursts open when you try to fit in one too many items — a single overflowing item can wreak havoc, spilling everything all over the place. This flaw can lead to serious consequences; an attacker could exploit it to execute arbitrary code on the system, potentially leading to total control over the application. This could mean accessing sensitive data, manipulating functions, or even crashing services — all absolutely devastating outcomes!

Put simply

Think of the vulnerability like a tightly packed suitcase that suddenly bursts open when you try to fit in one too many items — a single overflowing item can wreak havoc, spilling everything all over the place. The vulnerability arises from an integer overflow during the processing of floating point exponents in the js_strtod() function, resulting in a buffer overflow that could be exploited by attackers.

What to do

This flaw can lead to serious consequences; an attacker could exploit it to execute arbitrary code on the system, potentially leading to total control over the application. This could mean accessing sensitive data, manipulating functions, or even crashing services — all absolutely devastating outcomes! To protect yourself, upgrade to version 1.1.2 or later immediately. Ensure that all instances of Artifex MuJS are patched, and review your input validation processes to prevent malformed inputs from causing issues. 🛡️ You've got this! By following these steps, you can safeguard your applications and keep the internet a safer place! 🚀

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.4th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2023-04-17T00:00Z
EPSS history
Timeline
  • 17 APR 00:00Z
    Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1
    cvelistv5