Critical severity · published Jun 13, 2019
CVE-2019-12798
An issue was discovered in Artifex MuJS 1.0.5
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syntax list size.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
Mujs · Artifex
1.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12798
git.ghostscript.com
http://git.ghostscript.com/?p=mujs.git%3Bh=7f50591861525f76e3ec7a63392656ff8c030af9
www.securityfocus.com
http://www.securityfocus.com/bid/108774
More from Mujs
9.8
CVE-2021-33797
Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1
9.8
CVE-2021-45005
Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements
9.8
CVE-2019-11411
An issue was discovered in Artifex MuJS 1.0.5
9.8
CVE-2016-10133
Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc
9.8
CVE-2016-10141
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc