Use-after-free in Mujs - CVE-2022-44789

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing JavaScript files within the O_getOwnPropertyDescriptor() function. A remote attacker can pass a specially crafted JavaScript file to the application, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

How to mitigate CVE-2022-44789

Links to Public Exploits and PoC-codes

• Exploit #8780 - CVE-2022-44789 () (January 29, 2023)

External References

• https://github.com/alalng/CVE-2022-44789/blob/main/PublicReferenceURL.txt
• https://github.com/ccxvii/mujs/commit/edb50ad66f7601ca9a3544a0e9045e8a8c60561f
• https://github.com/ccxvii/mujs/releases/tag/1.3.2

Related Security Bulletins

• Remote code execution in Artifex MuJS
• Debian update for mujs
• openEuler 22.03 LTS update for mujs
• openEuler 22.03 LTS SP1 update for mujs
• Fedora 38 update for mujs
• Fedora 37 update for mujs