High severity · published Jan 30, 2017
CVE-2017-5628
An issue was discovered in Artifex Software, Inc
7.8
CVSS
1%
EPSS
No
On KEV
Description
An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
Mujs · Artifex
before 2017-01-24 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5628
git.ghostscript.com
http://git.ghostscript.com/?p=mujs.git%3Bh=8f62ea10a0af68e56d5c00720523ebcba13c2e6a
Third Party Advisory
http://www.securityfocus.com/bid/95855
Issue Tracking
https://bugs.ghostscript.com/show_bug.cgi?id=697496
More from Mujs
9.8
CVE-2021-33797
Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1
9.8
CVE-2021-45005
Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements
9.8
CVE-2019-12798
An issue was discovered in Artifex MuJS 1.0.5
9.8
CVE-2019-11411
An issue was discovered in Artifex MuJS 1.0.5
9.8
CVE-2016-10133
Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc