CVE-2024-38358 vulnerabilities

Vulnerabilities for packages: zellij, wasmer...

CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

CVE-2024-38358

Wasmer (a WASM runtime) is affected by CVE-2024-38358 due to a bug where preopened directories containing a symlink pointing outside can be exploited to traverse the symlink and access the host filesystem if the caller uses both oflags::creat and rights::fd_write. The issue can also crash the run...

cbqn (>=0.1.1, <=0.2.4), exers (0.2.0) +41 more potentially affected by CVE-2024-38358 via wasmer (>=4.0.0, <=4.3.0-beta.1)

wasmer CARGO version =4.0.0, =0.1.1, =0.3.0, =0.2.0, =0.6.0, =0.78.0, =0.3.0-beta-dev.35, =0.1.0, =0.1.0, =0.3.0-beta-dev.35, =0.3.0-beta-dev.35, =0.3.0, =0.5.0, =0.9.0, =0.0.1, =0.4.0-dev.7 and more Source cves: CVE-2024-38358 Source advisory: OSV:GHSA-55F3-3QVG-8PV5...