On 2026-09-27 05:19:07 +0000, Debian FTP Masters wrote:
> Changes:
> mujs (1.3.10-2) unstable; urgency=medium
> .
> * debian/patches
> + Add CVE-2026-88362.diff (Closes: #1149057)
> + Fix undefined behavior casting out-of-range int to double
According to the description of CVE-2026-88362, this is actually the
opposite: double to int. In practice, converting an int to double
cannot be out of range.
| MuJS e892c9fdb contains an incorrect numeric conversion
| vulnerability in jsR_isindex() in jsrun.c. A specially crafted
| JavaScript input containing an excessively large numeric array index
| can cause an out-of-range floating-point value to be converted to an
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| integer without proper range validation. This results in undefined
^^^^^^^
| behavior and can cause process termination, leading to denial of
| service.
--
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
