PT-2023-23179 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.8 Description: The issue occurs during codegen when the length word of a dynarray is written before the data. This can result in out-of-bounds array access when the dynarray is on both the lhs and rhs of an...

CVE-2023-31146: Out-of-bounds Write

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment...

barfs (0.1.2), cranefack (0.4.1) +49 more potentially affected by CVE-2023-26489 via cranelift-codegen (>=0.84.0, <=0.90.1)

cranelift-codegen CARGO version =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =10.0.0, =10.0.0, =17.0.0 and more Source cves: CVE-2023-26489 Source advisory: OSV:GHSA-FF4P-7XRQ-Q5R8...

barfs (0.1.2), cranelift (>=0.88.0, <=0.90.1) +20 more potentially affected by CVE-2023-27477 via cranelift-codegen (>=0.88.2, <=0.90.1)

cranelift-codegen CARGO version =0.88.2, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =0.88.0, =13.0.0, =13.0.0, =13.0.0, =23.0.0 and more Source cves: CVE-2023-27477 Source advisory: OSV:GHSA-XM67-587Q-R2VW...

wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64

Impact Wasmtime's code generation backend, Cranelift, has a bug on x8664 platforms for the WebAssembly i8x16.select instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one...

Malicious Package

Overview @realty-front/codegen is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

SUSE CVE-2014-3152

Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a...

Mozilla Firefox Resource Management Error Vulnerability (CNVD-2023-17321)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a resource management error that stems from an AliasSet bug used in JIT Codegen. An attacker could exploit the vulnerability to cause a denial of service with the help of special...

webkit2gtk3 security and bug fix update

glib2 2.56.4-159.0.1 - Rebuild with python 36 Orabug: 34701176 2.56.4-159 - Add --interface-info-body|header modes to gdbus-codegen - Related: 2061994 webkit2gtk3...

Exploit for Improper Privilege Management in Wfs Heaven_Burns_Red

EvilWfshbr CVE-2022-42046https://vulners.com/cve/CVE-2022-...

Fedora: Security Advisory for golang-github-deepmap-oapi-codegen (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-23636 +1 more via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:GHSA-7F6X-JWH5-M9R4...

Wasmtime 资源管理错误漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. A resource management error vulnerability exists in the code generator Cranelift in Wasmtime version 0.37.0, which stems from the fact that its developers may incorrectly be missing...

cranelift (0.84.0), cranelift-frontend (0.84.0) +19 more potentially affected by CVE-2022-31146 via cranelift-codegen (0.84.0)

cranelift-codegen CARGO version 0.84.0 is affected by a known vulnerability. The following packages have a transitive dependency on cranelift-codegen and may be impacted: - cranelift 0.84.0 - cranelift-frontend 0.84.0 - cranelift-interpreter 0.84.0 - cranelift-jit 0.84.0 - cranelift-module 0.84.0...

Fedora: Security Advisory for golang-github-deepmap-oapi-codegen (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Mozilla Firefox ESR Security Advisory (MFSA2022-14) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-31104 via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

Input validation

Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x8664 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bu...

CVE-2022-31104

CVE-2022-31104 concerns Wasmtime’s x86_64 SIMD implementation. Two Cranelift lowering bugs affected i8x16.swizzle and select for v128 inputs: swizzle overwrote the mask input register, potentially corrupting a constant; and select incorrectly handled 128‑bit vectors when the condition was 0, movi...

PT-2022-20531

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 0.38.1 cranelift-codegen versions prior to 0.85.1 Description The issue is related to Wasmtime's implementation of the SIMD proposal for WebAssembly on x86 64, which contained two bugs in the instruction lowerings...