https://github.com/alalng/CVE-2022-44789/blob/main/PublicReferenceURL.txt

https://github.com/ccxvii/mujs/commit/edb50ad66f7601ca9a3544a0e9045e8a8c60561f

https://github.com/ccxvii/mujs/releases/tag/1.3.2

DSA-5291

FEDORA-2022-c4b56e4400

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5291 advisory.

  - compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited     recursion, a different issue than CVE-2019-11413. (CVE-2022-30974)

  - In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated     by mujs-pp. (CVE-2022-30975)

  - A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an     attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted     JavaScript file. (CVE-2022-44789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2022-44789

high

Tenable Plugins

high