wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64

Impact Wasmtime's code generation backend, Cranelift, has a bug on x8664 platforms for the WebAssembly i8x16.select instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one...

Malicious Package

Overview @realty-front/codegen is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

SUSE CVE-2014-3152

Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a...

Mozilla Firefox Resource Management Error Vulnerability (CNVD-2023-17321)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a resource management error that stems from an AliasSet bug used in JIT Codegen. An attacker could exploit the vulnerability to cause a denial of service with the help of special...

webkit2gtk3 security and bug fix update

glib2 2.56.4-159.0.1 - Rebuild with python 36 Orabug: 34701176 2.56.4-159 - Add --interface-info-body|header modes to gdbus-codegen - Related: 2061994 webkit2gtk3...

Exploit for Improper Privilege Management in Wfs Heaven_Burns_Red

EvilWfshbr CVE-2022-42046https://vulners.com/cve/CVE-2022-...

Fedora: Security Advisory for golang-github-deepmap-oapi-codegen (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

abstraps (=0.1.8), aivm (>=0.2.0 <=0.3.0) +286 more potentially affected by CVE-2022-23636 +1 more via cranelift-codegen (>=0.14.0 <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:GHSA-7F6X-JWH5-M9R4...

Wasmtime 资源管理错误漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. A resource management error vulnerability exists in the code generator Cranelift in Wasmtime version 0.37.0, which stems from the fact that its developers may incorrectly be missing...

cranelift (=0.84.0), cranelift-frontend (=0.84.0) +18 more potentially affected by CVE-2022-31146 via cranelift-codegen (=0.84.0)

cranelift-codegen CARGO version =0.84.0 is affected by a known vulnerability. The following packages have a transitive dependency on cranelift-codegen and may be impacted: - cranelift =0.84.0 - cranelift-frontend =0.84.0 - cranelift-interpreter =0.84.0 - cranelift-jit =0.84.0 - cranelift-module...

Fedora: Security Advisory for golang-github-deepmap-oapi-codegen (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Mozilla Firefox ESR Security Advisory (MFSA2022-14) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

abstraps (=0.1.8), aivm (>=0.2.0 <=0.3.0) +286 more potentially affected by CVE-2022-31104 via cranelift-codegen (>=0.14.0 <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

Input validation

Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x8664 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bu...

CVE-2022-31104

CVE-2022-31104 concerns Wasmtime’s x86_64 SIMD implementation. Two Cranelift lowering bugs affected i8x16.swizzle and select for v128 inputs: swizzle overwrote the mask input register, potentially corrupting a constant; and select incorrectly handled 128‑bit vectors when the condition was 0, movi...

Malicious code in amplify-codegen-e2e-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78ef98fa45356b629d8b18e241e11d0b1aaa3f8b0bd38d3a357fc6707c297ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-978 Malicious code in amplify-codegen-e2e-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78ef98fa45356b629d8b18e241e11d0b1aaa3f8b0bd38d3a357fc6707c297ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5644 Malicious code in react-dts-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53dbff286a2669baf7872c7b3c62ef478e1e1d1a7f1f332b67a6227ec0220bb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3343 Malicious code in geoadv-proptypes-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86aa62f8baa2d8ed0fda95fc5065b753603886dd1331dfa3532b70d30be8ee11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3344 Malicious code in geoadv-ts-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c47caa11253203c249aa0ca38da1140e5ef612bc4d17f527da8642a3244108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...