CVE-2018-5759

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service (excessive recursion) via a crafted file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=4d45a96e57fbabf00a7378b337d0ddcace6f38c1
http://www.securityfocus.com/bid/102833Third Party Advisory, VDB Entry
https://bugs.ghostscript.com/show_bug.cgi?id=698868Permissions Required
https://www.exploit-db.com/exploits/43904/Exploit, Patch, Third Party Advisory, VDB Entry
http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=4d45a96e57fbabf00a7378b337d0ddcace6f38c1
http://www.securityfocus.com/bid/102833Third Party Advisory, VDB Entry
https://bugs.ghostscript.com/show_bug.cgi?id=698868Permissions Required
https://www.exploit-db.com/exploits/43904/Exploit, Patch, Third Party Advisory, VDB Entry

Timeline

Published: Jan 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-57618.1A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might ex CVE-2018-57625.9The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a CVE-2018-57635.9An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1. By entering specially crafted URLs, an attacker CVE-2018-57647.5The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote CVE-2018-57668.8In Libav through 12.2, there is an invalid memcpy in the av_packet_ref function of libavcodec/avpacket.c. Remote attackers could leverage th CVE-2018-57679.8An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the de CVE-2018-57689.8A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter f CVE-2018-57709.8An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd s CVE-2018-57725.5In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure function in the image.c CVE-2018-57736.1An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input a CVE-2018-57766.1WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).CVE-2018-57779.8An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Remote clients can take advantage of a misconfiguration in t