CVE-2018-5759

moderate-risk

Published 2018-01-24

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service (excessive recursion) via a crafted file.

Do I need to act?

3.8% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

43904

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Mujs

Affected Vendors

Artifex

References (8)

http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=4d45a96e57fbabf00a7378b337...

Third Party Advisory http://www.securityfocus.com/bid/102833

Permissions Required https://bugs.ghostscript.com/show_bug.cgi?id=698868

Exploit https://www.exploit-db.com/exploits/43904/

http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=4d45a96e57fbabf00a7378b337...

Third Party Advisory http://www.securityfocus.com/bid/102833

Permissions Required https://bugs.ghostscript.com/show_bug.cgi?id=698868

Exploit https://www.exploit-db.com/exploits/43904/

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 7/34 · Low

Exposure 5/34 · Minimal