Rhino
Monthly
Denial of service via CPU exhaustion in Mozilla Rhino versions prior to 1.7.14.1, 1.7.15.1, and 1.8.1. A remote attacker can pass a specially crafted small floating-point number to the toFixed() function, triggering excessive exponentiation in the pow5mult routine and consuming CPU resources. Exploit code is publicly available, though no active exploitation has been reported at this time.
Denial of service via CPU exhaustion in Mozilla Rhino versions prior to 1.7.14.1, 1.7.15.1, and 1.8.1. A remote attacker can pass a specially crafted small floating-point number to the toFixed() function, triggering excessive exponentiation in the pow5mult routine and consuming CPU resources. Exploit code is publicly available, though no active exploitation has been reported at this time.