Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
211 results · page 4 of 5
Mar 8, 2023wasmtime is a fast and secure runtime for WebAssembly.CVE-2023-27477 · Other software · bytecodealliance · reported by GitHubLow 3.1
wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023wasmtime is a fast and secure runtime for WebAssembly.CVE-2023-26489 · Other software · bytecodealliance · reported by GitHubCritical 9.9
wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined 33-bit effective address. This bug means that, with default codegen settings, a wasm-controlled load/store operation could read/write addresses up to 35 bits away from the base of linear memory. Due to this bug, however, addresses up to `0xffffffff * 8 + 0x7ffffffc = 36507222004 = ~34G` bytes away from the base of linear memory are possible from guest code. This means that the virtual memory 6G away from the base of linear memory up to ~34G away can be read/written by a malicious module. A guest module can, without the knowledge of the embedder, read/write memory in this region. The memory may belong to other WebAssembly instances when using the pooling allocator, for example. Affected embedders are recommended to analyze preexisting wasm modules to see if they're affected by the incorrect codegen rules and possibly correlate that with an anomalous number of traps during historical execution to locate possibly suspicious modul
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-39394 · Other software · bytecodealliance · reported by GitHubLow 3.8
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-39393 · Other software · bytecodealliance · reported by GitHubHigh 8.6
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-39392 · Other software · bytecodealliance · reported by GitHubMedium 5.9
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration, the virtual memory mapping for WebAssembly memories did not meet the compiler-required configuration requirements for safely executing WebAssembly modules. Wasmtime's default settings require virtual memory page faults to indicate that wasm reads/writes are out-of-bounds, but the pooling allocator's configuration would not create an appropriate virtual memory mapping for this meaning out of bounds reads/writes can successfully read/write memory unrelated to the wasm sandbox within range of the base address of the memory mapping created by the pooling allocator. This bug is not applicable with the default settings of the `wasmtime` crate. This bug can only be triggered by setting `InstanceLimits::memory_pages` to zero. This is expected to be a very rare configuration since this means that wasm modules cannot allocate any pages of linear memory. All wasm modules produced by all current toolchains are highly likely t
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.CVE-2022-43283 · Other software · Webassembly · reported by MITREMedium 5.5
wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount.CVE-2022-43282 · Other software · Webassembly · reported by MITREHigh 7.1
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.CVE-2022-43281 · Other software · Webassembly · reported by MITREHigh 7.8
wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.h.
- Product
- Wasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount.CVE-2022-43280 · Other software · Webassembly · reported by MITREHigh 7.1
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-31169 · Other software · bytecodealliance · reported by GitHubMedium 5.9
Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly but does affect the correctness of guest programs. This bug has been patched in Wasmtime version 0.38.2 and cranelift-codegen 0.85.2. There are no known workarounds.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-31146 · Other software · bytecodealliance · reported by GitHubMedium 6.4
Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2. Mitigations for this issue can be achieved by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types` or downgrading to Wasmtime 0.36.0 or prior.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-31104 · Other software · bytecodealliance · reported by GitHubMedium 4.8
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. The correspondingly affected Cranelift instructions were `swizzle` and `select`. The `swizzle` instruction lowering in Cranelift erroneously overwrote the mask input register which could corrupt a constant value, for example. This means that future uses of the same constant may see a different value than the constant itself. The `select` instruction lowering in Cranelift wasn't correctly implemented for vector types that are 128-bits wide. When the condition was 0 the wrong instruction was used to move the correct input to the output of the instruction meaning that only the low 32 bits were moved and the upper 96 bits of the result were left as whatever the register previously contained (instead of the input being moved from). The `se
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift.CVE-2022-24791 · Other software · bytecodealliance · reported by GitHubHigh 8.1
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-ea
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2022-23636 · Other software · bytecodealliance · reported by GitHubMedium 5.1
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective impact of this bug is relatively small because the usage of `externref` is still uncommon and without a resource limiter configured on the `Store`, which is not the default configuration, it is only possible to trigger the bug from an error returned by `mprotect` or `VirtualAlloc`. Note that on Linux with the `uffd` feature enabled, it is only possible to trigger the bug from a resource limiter as the call to `mprotect` is skipped. The bug has been fixed in 0.34.1 and 0.33.1 and users are encouraged to upgrade as soon as possible. If it is not possible to upgrade to version 0.34.1 or 0.33.1 of the `wasmtime` crate, it is recommend that support for the reference types proposal be
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).CVE-2021-46055 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).CVE-2021-46054 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 103.CVE-2021-46053 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.CVE-2021-46052 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.CVE-2021-46050 · Other software · Webassembly · reported by MITREMedium 5.5
A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.CVE-2021-46048 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.CVE-2021-45293 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Dec 21, 2021A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.CVE-2021-45290 · Other software · Webassembly · reported by MITREHigh 7.5
A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Nov 29, 2021Lucet is a native WebAssembly compiler and runtime.CVE-2021-43790 · Other software · bytecodealliance · reported by GitHubHigh 8.5
Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Instance is dropped. Users should upgrade to the main branch of the Lucet repository. Lucet no longer provides versioned releases on crates.io. There is no way to remediate this vulnerability without upgrading.
- Product
- lucet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2018-6122 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2021-39218 · Other software · bytecodealliance · reported by GitHubMedium 6.3
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a fre
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2021-39219 · Other software · bytecodealliance · reported by GitHubMedium 6.3
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type. Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`). It's expected that usage of more-than-one `Engine` in an embedding is relatively rare sin
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2021-39216 · Other software · bytecodealliance · reported by GitHubMedium 6.3
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the host. If you do not have host code that matches one of these shapes, then you are not impacted. If Wasmtime's `VMExternRefActivationsTable` became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed. We have reason to believe that the effective impact of
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash.CVE-2021-29945 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Aug 28, 2019An issue was discovered in Binaryen 1.38.32.CVE-2019-15759 · Other software · Webassembly · reported by MITREMedium 6.5
An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2019An issue was discovered in Binaryen 1.38.32.CVE-2019-15758 · Other software · Webassembly · reported by MITREMedium 6.5
An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2019Object lifecycle issue in WebAssembly in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMLCVE-2018-6131 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Object lifecycle issue in WebAssembly in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Feb 10, 2019wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-mergCVE-2019-7704 · Other software · Webassembly · reported by MITREMedium 6.5
wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp.CVE-2019-7703 · Other software · Webassembly · reported by MITREMedium 6.5
In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22.CVE-2019-7702 · Other software · Webassembly · reported by MITREMedium 6.5
A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22.CVE-2019-7701 · Other software · Webassembly · reported by MITREMedium 6.5
A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm2js.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22.CVE-2019-7700 · Other software · Webassembly · reported by MITREMedium 6.5
A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2019An assertion failure was discovered in wasm::WasmBinaryBuilder::getType() in wasm-binary.cpp in Binaryen 1.38.22.CVE-2019-7662 · Other software · Webassembly · reported by MITREMedium 6.5
An assertion failure was discovered in wasm::WasmBinaryBuilder::getType() in wasm-binary.cpp in Binaryen 1.38.22. This allows remote attackers to cause a denial of service (failed assertion and crash) via a crafted wasm file.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2019The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinCVE-2019-7154 · Other software · Webassembly · reported by MITREMedium 6.5
The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2019A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctCVE-2019-7153 · Other software · Webassembly · reported by MITREMedium 6.5
A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2019A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFuCVE-2019-7152 · Other software · Webassembly · reported by MITREMedium 6.5
A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2019A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22.CVE-2019-7151 · Other software · Webassembly · reported by MITREMedium 6.5
A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code iCVE-2018-17458 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comchromereleases.googleblog.com
Jan 9, 2019A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a remCVE-2017-15401 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Dec 4, 2018A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a CVE-2018-6116 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Dec 4, 2018An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandboCVE-2018-6092 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Dec 4, 2018A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML CVE-2018-6087 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Nov 14, 2018A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corrupCVE-2018-6061 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Sep 21, 2018An issue was discovered in WAVM before 2018-09-16.CVE-2018-17293 · Other software · Webassembly Virtual Machine Project · reported by MITREHigh 8.8
An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.
- Product
- Webassembly Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018An issue was discovered in WAVM before 2018-09-16.CVE-2018-17292 · Other software · Webassembly Virtual Machine Project · reported by MITREMedium 6.5
An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of the file length before a file magic comparison, allowing attackers to cause a Denial of Service (application crash caused by out-of-bounds read) by crafting a file that has fewer than 4 bytes.
- Product
- Webassembly Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2018In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecifieCVE-2018-16770 · Other software · Webassembly Virtual Machine Project · reported by MITREHigh 8.8
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because a certain new_allocator allocate call fails.
- Product
- Webassembly Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.