Описание
Security update for rhino
This update for rhino fixes the following issues:
Update to 1.7.15.1:
- CVE-2025-66453: Fixed a problem with formatting of floating-point numbers to strings that may result in DoS (bsc#1254481).
Список пакетов
openSUSE Leap 16.0
rhino-1.7.15.1-160000.1.1
rhino-demo-1.7.15.1-160000.1.1
rhino-engine-1.7.15.1-160000.1.1
rhino-javadoc-1.7.15.1-160000.1.1
rhino-runtime-1.7.15.1-160000.1.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1254481
- SUSE CVE CVE-2025-66453 page
Описание
Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.
Затронутые продукты
openSUSE Leap 16.0:rhino-1.7.15.1-160000.1.1
openSUSE Leap 16.0:rhino-demo-1.7.15.1-160000.1.1
openSUSE Leap 16.0:rhino-engine-1.7.15.1-160000.1.1
openSUSE Leap 16.0:rhino-javadoc-1.7.15.1-160000.1.1
Ссылки
- CVE-2025-66453
- SUSE Bug 1254481