An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.

A new version of mujs is now available for Fedora and EPEL. Besides generic enhancements and bugfixes, this release also fixes three tracked security issues: CVE-2019-11411, CVE-2019-11412 and CVE-2019-11413.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-52 (mujs: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in mujs. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
142671	Fedora 33 : mujs (2020-f3d08b9b3a)	Nessus	Fedora Local Security Checks	critical
142669	Fedora 31 : mujs (2020-53773f4954)	Nessus	Fedora Local Security Checks	critical
142666	Fedora 32 : mujs (2020-496ab4615a)	Nessus	Fedora Local Security Checks	critical
139115	GLSA-202007-52 : mujs: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2019-11411

critical

Tenable Plugins

critical

critical

critical

critical