Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-22885: mujs before 1.0.8 can crash when handling data
CVE-2020-22885 · published 5 years ago
Summary
The mujs JavaScript engine version earlier than 1.0.8 on Debian can be forced to stop working by specially crafted input that triggers a programming error. This could interrupt services that rely on mujs, effectively causing a denial of service. Upgrade mujs to version 1.0.8 or later to prevent the issue.
What to do
- Update debian mujs to version 1.0.9-1.
- Update artifex mujs to version 1.0.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | mujs |
< 1.0.9-1 Fix: upgrade to 1.0.9-1
|
| Debian:13 | debian | mujs |
< 1.0.9-1 Fix: upgrade to 1.0.9-1
|
| Debian:14 | debian | mujs |
< 1.0.9-1 Fix: upgrade to 1.0.9-1
|
| – | artifex | mujs |
< 1.0.8 cpe:2.3:a:artifex:mujs:*:*:*:*:*:*:*:* |
Original advisory text
Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of service.
Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of service.
References
- https://security-tracker.debian.org/tracker/CVE-2020-22885 Vendor Advisory
- https://github.com/ccxvii/mujs/issues/133 Exploit Third Party Advisory
Severity
7.5
High
Type
CWE-120Classic Buffer Overflow
Timeline
Published13 Jul 2021
Updated3 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta