Mozilla: Content process crash due to invalid wasm code

The Mozilla Foundation Security Advisory describes this flaw as: A type checking bug would have led to invalid code being compiled...

DEBIAN-CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

Design/Logic Flaw

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

UBUNTU-CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300

CVE-2023-30300 describes an infinite loop in the hang.wasm component of WebAssembly 1.0. The issue is documented across multiple sources (NVD, OSV, Debian/Ubuntu OSSVs, Fedora/Nessus plugins) with a common root cause: hang.wasm causes unbounded execution, leading to availability impact. CVSS 3.1 ...

CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

CVE-2023-30300: Loop with Unreachable Exit Condition

An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop...

WebAssembly security vulnerabilities

WebAssembly is a binary instruction format for stack-based virtual machines from WebAssembly. A security vulnerability exists in WebAssembly version 1.0, which stems from a problem with the component hang.wasm that results in a dead loop...

PT-2023-22626 · Unknown +1 · Webassembly +1

Name of the Vulnerable Software and Affected Versions: WebAssembly version 1.0 Description: An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop. Recommendations: For WebAssembly version 1.0, consider disabling the hang.wasm component as a temporary workaround until a...

CVE-2023-30624

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled...

CVE-2023-30624 Wasmtime has Undefined Behavior in Rust runtime functions

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled...

CVE-2023-30624

Wasmtime CVE-2023-30624 concerns an LLVM-level undefined behavior in per-instance state management (VMContext) of the Wasmtime runtime. The issue occurs in Wasmtime versions prior to 6.0.2, 7.0.1, and 8.0.1 and arises when unsafe code mutates VMContext data via methods using &self, which can lead...

Cranelift Wasmtime Buffer Overflow DoS

The vulnerability of the Cranelift compiler previously Cretonne for WebAssembly applications relates to the execution environment. This vulnerability stems from the operation of pushing an instruction out of the buffer into memory when determining linear memory addressing rules. Exploiting this...

wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend Cranelift has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1 5.0.1 and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.

...