What’s Vulnerable › Vulnerabilities

CVE-2016-9294

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-11-12 · updated 2026-06-17
• Weakness: CWE-476

Description

Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service (application crash)" attacks by using the "malformed labeled break/continue in JavaScript" approach, related to a "NULL pointer dereference" issue affecting the jscompile.c component.

Affected products

• MuJS: before 2016-10-26 — fixed in 2016-10-26

How to fix

Upgrade to a fixed version: MuJS 2016-10-26. Check the vendor advisory for mitigations.

References

• http://bugs.ghostscript.com/show_bug.cgi?id=697172
• http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=5008105780c0b0182ea6eda83ad5598f225be3ee
• http://www.securityfocus.com/bid/94293
• http://bugs.ghostscript.com/show_bug.cgi?id=697172
• http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=5008105780c0b0182ea6eda83ad5598f225be3ee
• http://www.securityfocus.com/bid/94293

Get alerted when CVE-2016-9294 or the next vulnerability affects your stack