The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5291 advisory.

  - compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited     recursion, a different issue than CVE-2019-11413. (CVE-2022-30974)

  - In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated     by mujs-pp. (CVE-2022-30975)

  - A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an     attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted     JavaScript file. (CVE-2022-44789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Debian DSA-5291-1 : mujs - security update

high Nessus Plugin ID 168232

Version 1.3

Version 1.2

Version 1.3 Nov 30, 2022, 4:19 PM CVSS metrics ("CVSSv3 score" changed from "7.8" to "8.8") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H")
Version 1.2 Nov 29, 2022, 5:50 AM New