Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
255 results · page 4 of 6
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27935 · Other software · denoland · reported by GitHubHigh 7.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27934 · Other software · denoland · reported by GitHubHigh 8.4
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, which is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable for both `*const c_void` and `ExternalPointer` implementations. Version 1.40.3 fixes this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27933 · Other software · denoland · reported by GitHubHigh 8.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`, which returns a `IpcJsonStreamResource` ID associated with the file descriptor. On closing the resource, the raw file descriptor is closed together. Use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors. This allow standard input (fd 0) to be closed and re-opened for a different resource, which allows a silent permission prompt bypass. This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. The attack can
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27932 · Other software · denoland · reported by GitHubMedium 4.6
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-27931 · Other software · denoland · reported by GitHubMedium 5.8
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path traversal characters. This is fixed in Deno 1.41.1.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911.CVE-2023-40266 · Email & office · Mitel · reported by MITRECritical 9.8
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal.
- Product
- Unify Openscape Xpressions Webassistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comnetworks.unify.com
Feb 8, 2024An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911.CVE-2023-40265 · Email & office · Mitel · reported by MITREHigh 8.8
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload.
- Product
- Unify Openscape Xpressions Webassistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comnetworks.unify.com
Dec 31, 2023Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly CVE-2023-52284 · Other software · Bytecodealliance · reported by MITREMedium 5.5
Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.
- Product
- Webassembly Micro Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser.CVE-2023-51661 · Other software · wasmerio · reported by GitHubHigh 8.4
Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.
- Product
- wasmer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasmCVE-2023-48105 · Other software · Bytecodealliance · reported by MITREHigh 7.5
An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.
- Product
- Webassembly Micro Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.CVE-2023-46331 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.CVE-2023-46332 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Wasmtime is a standalone runtime for WebAssembly.CVE-2023-41880 · Other software · bytecodealliance · reported by GitHubLow 2.2
Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact of this issue is that any WebAssembly program using the `i64x2.shr_s` with a constant shift amount larger than 32 may produce an incorrect result. This issue is not an escape from the WebAssembly sandbox. Execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless. This issue was discovered through fuzzing of Wasmtime's code generator Cranelift. Wasmtime versions 10.0.2, 11.0.2, and 12.0.2 are all patched to no longer have this miscompilation. T
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26.CVE-2020-18382 · Other software · Webassembly · reported by MITREMedium 6.5
Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-opt.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26.CVE-2020-18378 · Other software · Webassembly · reported by MITREMedium 6.5
A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").CVE-2023-31669 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 22, 2023An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crCVE-2023-31670 · Other software · Webassembly · reported by MITREHigh 7.5
An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary.
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.CVE-2023-30300 · Other software · W3 · reported by MITREMedium 5.5
An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Apr 27, 2023Wasmtime is a standalone runtime for WebAssembly.CVE-2023-30624 · Other software · bytecodealliance · reported by GitHubLow 3.9
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled with LLVM 16 which causes some writes, which are critical for correctness, to be optimized away. Vulnerable versions of Wasmtime compiled with Rust 1.70, which is currently in beta, or later are known to have incorrectly compiled functions. Versions of Wasmtime compiled with the current Rust stable release, 1.69, and prior are not known at this time to have any issues, but can theoretically exhibit potential issues. The underlying problem is that Wasmtime's runtime state for an instance involves a Rust-defined structure called `Instance` which has a trailing `VMContext` structure after it. This `VMContext` structure has a runtime-defined layout that is unique per-module. This representation cannot be expressed with safe code in Rust so `unsafe` code is required to maintain this state. The code doing this, however, has methods which take `&self` as an argument but modify data in the `VMCon
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.CVE-2023-27119 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.CVE-2023-27117 · Other software · Webassembly · reported by MITREHigh 7.8
WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.CVE-2023-27116 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 9, 2023WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.CVE-2023-27115 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023wasmtime is a fast and secure runtime for WebAssembly.CVE-2023-27477 · Other software · bytecodealliance · reported by GitHubLow 3.1
wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023wasmtime is a fast and secure runtime for WebAssembly.CVE-2023-26489 · Other software · bytecodealliance · reported by GitHubCritical 9.9
wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined 33-bit effective address. This bug means that, with default codegen settings, a wasm-controlled load/store operation could read/write addresses up to 35 bits away from the base of linear memory. Due to this bug, however, addresses up to `0xffffffff * 8 + 0x7ffffffc = 36507222004 = ~34G` bytes away from the base of linear memory are possible from guest code. This means that the virtual memory 6G away from the base of linear memory up to ~34G away can be read/written by a malicious module. A guest module can, without the knowledge of the embedder, read/write memory in this region. The memory may belong to other WebAssembly instances when using the pooling allocator, for example. Affected embedders are recommended to analyze preexisting wasm modules to see if they're affected by the incorrect codegen rules and possibly correlate that with an anomalous number of traps during historical execution to locate possibly suspicious modul
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-39394 · Other software · bytecodealliance · reported by GitHubLow 3.8
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-39393 · Other software · bytecodealliance · reported by GitHubHigh 8.6
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-39392 · Other software · bytecodealliance · reported by GitHubMedium 5.9
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration, the virtual memory mapping for WebAssembly memories did not meet the compiler-required configuration requirements for safely executing WebAssembly modules. Wasmtime's default settings require virtual memory page faults to indicate that wasm reads/writes are out-of-bounds, but the pooling allocator's configuration would not create an appropriate virtual memory mapping for this meaning out of bounds reads/writes can successfully read/write memory unrelated to the wasm sandbox within range of the base address of the memory mapping created by the pooling allocator. This bug is not applicable with the default settings of the `wasmtime` crate. This bug can only be triggered by setting `InstanceLimits::memory_pages` to zero. This is expected to be a very rare configuration since this means that wasm modules cannot allocate any pages of linear memory. All wasm modules produced by all current toolchains are highly likely t
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.CVE-2022-43283 · Other software · Webassembly · reported by MITREMedium 5.5
wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount.CVE-2022-43282 · Other software · Webassembly · reported by MITREHigh 7.1
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.CVE-2022-43281 · Other software · Webassembly · reported by MITREHigh 7.8
wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.h.
- Product
- Wasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount.CVE-2022-43280 · Other software · Webassembly · reported by MITREHigh 7.1
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-41308 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-41307 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-41305 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 3, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-41301 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 22, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-31169 · Other software · bytecodealliance · reported by GitHubMedium 5.9
Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly but does affect the correctness of guest programs. This bug has been patched in Wasmtime version 0.38.2 and cranelift-codegen 0.85.2. There are no known workarounds.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-31146 · Other software · bytecodealliance · reported by GitHubMedium 6.4
Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2. Mitigations for this issue can be achieved by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types` or downgrading to Wasmtime 0.36.0 or prior.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Wasmtime is a standalone runtime for WebAssembly.CVE-2022-31104 · Other software · bytecodealliance · reported by GitHubMedium 4.8
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. The correspondingly affected Cranelift instructions were `swizzle` and `select`. The `swizzle` instruction lowering in Cranelift erroneously overwrote the mask input register which could corrupt a constant value, for example. This means that future uses of the same constant may see a different value than the constant itself. The `select` instruction lowering in Cranelift wasn't correctly implemented for vector types that are 128-bits wide. When the condition was 0 the wrong instruction was used to move the correct input to the output of the instruction meaning that only the low 32 bits were moved and the upper 96 bits of the result were left as whatever the register previously contained (instead of the input being moved from). The `se
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift.CVE-2022-24791 · Other software · bytecodealliance · reported by GitHubHigh 8.1
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-ea
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2022-23636 · Other software · bytecodealliance · reported by GitHubMedium 5.1
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective impact of this bug is relatively small because the usage of `externref` is still uncommon and without a resource limiter configured on the `Store`, which is not the default configuration, it is only possible to trigger the bug from an error returned by `mprotect` or `VirtualAlloc`. Note that on Linux with the `uffd` feature enabled, it is only possible to trigger the bug from a resource limiter as the call to `mprotect` is skipped. The bug has been fixed in 0.34.1 and 0.33.1 and users are encouraged to upgrade as soon as possible. If it is not possible to upgrade to version 0.34.1 or 0.33.1 of the `wasmtime` crate, it is recommend that support for the reference types proposal be
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).CVE-2021-46055 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).CVE-2021-46054 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 103.CVE-2021-46053 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.CVE-2021-46052 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.CVE-2021-46050 · Other software · Webassembly · reported by MITREMedium 5.5
A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.CVE-2021-46048 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.CVE-2021-45293 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Dec 21, 2021A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.CVE-2021-45290 · Other software · Webassembly · reported by MITREHigh 7.5
A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Nov 29, 2021Lucet is a native WebAssembly compiler and runtime.CVE-2021-43790 · Other software · bytecodealliance · reported by GitHubHigh 8.5
Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Instance is dropped. Users should upgrade to the main branch of the Lucet repository. Lucet no longer provides versioned releases on crates.io. There is no way to remediate this vulnerability without upgrading.
- Product
- lucet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.