7.8high
CVE-2017-5628
An issue was discovered in Artifex Software, Inc.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known
Summary
An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file.
Exploit prediction (EPSS)
1.03% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-190 Integer Overflow or Wraparound
References
- git.ghostscript.com /?p=mujs.git%3Bh=8f62ea10a0af68e56d5c00720523ebcba13c2e6a · x_refsource_CONFIRM, x_transferred
- bugs.ghostscript.com /show_bug.cgi?id=697496 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/95855 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-5628
- NVD: CVE-2017-5628
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.