CVE-2019-11413

moderate-risk

Published 2019-04-22

An issue was discovered in Artifex MuJS 1.0.5. It has unlimited recursion because the match function in regexp.c lacks a depth check.

Do I need to act?

0.84% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Mujs

Artifex

Patch http://www.ghostscript.com/cgi-bin/findgit.cgi?00d4606c3baf813b7b1c176823b2729bf...

Third Party Advisory http://www.securityfocus.com/bid/108093

Issue Tracking https://bugs.ghostscript.com/show_bug.cgi?id=700937

Patch https://github.com/ccxvii/mujs/commit/00d4606c3baf813b7b1c176823b2729bf51002a2

https://security.gentoo.org/glsa/202007-52

Patch http://www.ghostscript.com/cgi-bin/findgit.cgi?00d4606c3baf813b7b1c176823b2729bf...

Third Party Advisory http://www.securityfocus.com/bid/108093

Issue Tracking https://bugs.ghostscript.com/show_bug.cgi?id=700937

Patch https://github.com/ccxvii/mujs/commit/00d4606c3baf813b7b1c176823b2729bf51002a2

https://security.gentoo.org/glsa/202007-52

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 5/34 · Minimal