Bug 1390266 (CVE-2016-7504, CVE-2016-7505, CVE-2016-7506, CVE-2016-9017, CVE-2016-9108, CVE-2016-9109) - CVE-2016-7504 CVE-2016-7505 CVE-2016-7506 CVE-2016-9017 CVE-2016-9108 CVE-2016-9109 mujs: Multiple security issues
Summary: CVE-2016-7504 CVE-2016-7505 CVE-2016-7506 CVE-2016-9017 CVE-2016-9108 CVE-201...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-7504, CVE-2016-7505, CVE-2016-7506, CVE-2016-9017, CVE-2016-9108, CVE-2016-9109
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1390268
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-31 15:16 UTC by Andrej Nemec
Modified: 2019-09-29 13:59 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-13 09:43:22 UTC
Embargoed:


Attachments (Terms of Use)

Description Andrej Nemec 2016-10-31 15:16:57 UTC
Mujs received multiple CVEs for security issues.

CVE-2016-9108: Integer overflow and crash parsing regex in mujs

http://seclists.org/oss-sec/2016/q4/275

CVE-2016-9109: Incomplete fix for CVE-2016-7563

http://seclists.org/oss-sec/2016/q4/276

CVE-2016-7506: OOB read vulnerability in Sp_replace_regexp function

http://bugs.ghostscript.com/show_bug.cgi?id=697141

CVE-2016-7505: Buffer overflow in divby function

http://bugs.ghostscript.com/show_bug.cgi?id=697140

CVE-2016-7504: Use-after-free in Rp_toString function

http://bugs.ghostscript.com/show_bug.cgi?id=697142

CVE-2016-9017: OOB read in jsC_dumpfunction function

http://bugs.ghostscript.com/show_bug.cgi?id=697171

Comment 1 Andrej Nemec 2016-10-31 15:18:14 UTC
Created mujs tracking bugs for this issue:

Affects: fedora-all [bug 1390268]

Comment 2 Petr Šabata 2016-11-16 11:37:16 UTC
(In reply to Andrej Nemec from comment #0)
> CVE-2016-7506: OOB read vulnerability in Sp_replace_regexp function
> 
> http://bugs.ghostscript.com/show_bug.cgi?id=697141

This is already fixed in Fedora, included in mujs-0-5.20160921git5c337af.fc23.

> CVE-2016-7505: Buffer overflow in divby function
> 
> http://bugs.ghostscript.com/show_bug.cgi?id=697140

So is this.

> CVE-2016-7504: Use-after-free in Rp_toString function
> 
> http://bugs.ghostscript.com/show_bug.cgi?id=697142

And this too.

Comment 3 Petr Šabata 2016-11-16 11:50:34 UTC
(In reply to Andrej Nemec from comment #0)
> Mujs received multiple CVEs for security issues.
> 
> CVE-2016-9108: Integer overflow and crash parsing regex in mujs
> 
> http://seclists.org/oss-sec/2016/q4/275

Should be fixed in b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e.

> CVE-2016-9109: Incomplete fix for CVE-2016-7563
> 
> http://seclists.org/oss-sec/2016/q4/276

Fixed in a0ceaf5050faf419401fe1b83acfa950ec8a8a89.
 
> CVE-2016-9017: OOB read in jsC_dumpfunction function
> 
> http://bugs.ghostscript.com/show_bug.cgi?id=697171

Also fixed in a5c747f1d40e8d6659a37a8d25f13fb5acf8e767.


I will include these fixes in a rebase.


Note You need to log in before you can comment on or make changes to this bug.