CVE-2022-40957

In Firefox on ARM64, CVE-2022-40957 is caused by inconsistent data in the instruction and data caches while building WebAssembly code, leading to a potentially exploitable crash. Affected products include Firefox on ARM64 and Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox

CVE-2022-31740

On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

nodejs:16 security, bug fix, and enhancement update

nodejs 1:16.18.1-3 - Update sources of undici WASM blobs Resolves: rhbz2151546 1:16.18.1-2 - Record CVE references already addressed in this or previous upstream versions Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824 1:16.18.1-1 - Rebase + CVE fixes - Resolves: 2142806 -...

nodejs:18 security update

nodejs 1:18.8.0-1 - Rebase to version 18.8.0 - Include sources for WASM blobs nodejs-packaging 2021.06-4 - NPM bundler: also find namespaced bundled dependencies 2021.06-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora35MassRebuild 2021.06-2 - Fix hard-coded output directory in the bundler...

Wasmtime out of bounds read/write with zero-memory-pages configuration

Impact There is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration the virtual memory mapping for WebAssembly memories did not meet the compiler-required...

UBUNTU-CVE-2022-39392

Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration, the virtual memory mappi...

RUSTSEC-2022-0076 Bug in Wasmtime implementation of pooling instance allocator

Bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration, the virtual memory mapping for WebAssembly memories did not meet the compiler-required configuration...

auto-wasi (=0.1.0), candid-extractor (>=0.1.0 <=0.1.2) +99 more potentially affected by CVE-2022-39392 via wasmtime (>=0.10.0 <=12.0.2)

wasmtime CARGO version =0.10.0, =0.1.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0, =0.4.0, =0.0.0, =0.5.0, =0.0.1-alpha, =0.40.1, =0.45.0, =0.1.0, =0.3.0 - inkpad-executor =0.1.0 and more Source cves: CVE-2022-39392 Source advisory: OSV:RUSTSEC-2022-0102...

DEBIAN-CVE-2022-43281

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

PYSEC-2022-43187

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

CVE-2022-43281

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

DEBIAN-CVE-2022-43280

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr-GetReturnCallDropKeepCount...

CVE-2022-43282

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr-GetReturnCallDropKeepCount...

CVE-2022-43280

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr-GetReturnCallDropKeepCount...

CVE-2022-43282

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr-GetReturnCallDropKeepCount...

CVE-2022-43281

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

CVE-2022-43280

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr-GetReturnCallDropKeepCount...

UBUNTU-CVE-2022-43280

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr-GetReturnCallDropKeepCount...

UBUNTU-CVE-2022-43281

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

UBUNTU-CVE-2022-43282

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr-GetReturnCallDropKeepCount...