Bug#1121953: rhino: CVE-2025-66453

[Salvatore Bonaccorso]

Source: rhino
Version: 1.7.15-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for rhino.

CVE-2025-66453[0]:
| Rhino is an open-source implementation of JavaScript written
| entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an
| application passed an attacker controlled float poing number into
| the toFixed() function, it might lead to high CPU consumption and a
| potential Denial of Service. Small numbers go through this call
| stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa >
| DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous
| power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-66453
    https://www.cve.org/CVERecord?id=CVE-2025-66453
[1] https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore