Description
An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.
References
- https://bugs.ghostscript.com/show_bug.cgi?id=700938
- http://www.ghostscript.com/cgi-bin/findgit.cgi?da632ca08f240590d2dec786722ed08486ce1be6
- https://github.com/ccxvii/mujs/commit/da632ca08f240590d2dec786722ed08486ce1be6
- 108093 vdb-entry
- GLSA-202007-52 vendor-advisory
- FEDORA-2020-53773f4954 vendor-advisory
- FEDORA-2020-496ab4615a vendor-advisory
- FEDORA-2020-f3d08b9b3a vendor-advisory