Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function
Résumé
Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-66453 rhino
- Ubuntu UBUNTU-CVE-2025-66453 rhino
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov