Bug 1210559 (CVE-2021-33797) - VUL-0: CVE-2021-33797: mujs: buffer-overflow in jsdtoa.c
Summary: VUL-0: CVE-2021-33797: mujs: buffer-overflow in jsdtoa.c
Status: RESOLVED FIXED
Alias: CVE-2021-33797
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Adam Majer
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/363724/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-18 06:12 UTC by Alexander Bergmann
Modified: 2023-04-18 06:12 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-04-18 06:12:00 UTC 
CVE-2021-33797

Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An
integer overflow happens when js_strtod() reads in floating point exponent,
which leads to a buffer overflow in the pointer *d.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33797
https://www.cve.org/CVERecord?id=CVE-2021-33797
http://www.cvedetails.com/cve/CVE-2021-33797/
https://github.com/ccxvii/mujs/commit/833b6f1672b4f2991a63c4d05318f0b84ef4d550
https://github.com/ccxvii/mujs/issues/148
Comment 1 Alexander Bergmann 2023-04-18 06:12:45 UTC 
Already fixed with our code-stream versions:

openSUSE:Backports:SLE-15-SP5     mujs-1.3.2
openSUSE:Factory                  mujs-1.3.2