1135 matches found
wasmtime:call_async: Null-dereference READ in wasmtime::runtime::vm::sys::unix::signals::trap_handler::ha6c97a5308add0e4
Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=4575298041741312 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: callasync Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Null-dereference READ Crash Address:...
CVE-2022-24791
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption it is disabled by default...
CVE-2022-39393
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously ...
wasmtime:wast_tests: Crash in wasmtime::compile::build_artifacts::hf3481d0f66afb588
Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=6737034672144384 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: wasttests Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x782d378620...
wasmtime:wast_tests: Crash in wasmtime::compile::build_artifacts::hd9b076400f1b289f
Detailed Report: https://oss-fuzz.com/testcase?key=6135436489064448 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: wasttests Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7ef9689d7000 Crash State:...
wasmtime:wast_tests: Crash in wasmtime::compile::FunctionIndices::link_and_append_code::h85cd012c921cNUMBER
Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5288372842594304 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: wasttests Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7ca7f9d888...
GHSA-HXF5-99XG-86HW vulnerabilities
Vulnerabilities for packages: zed, wasmtime, wasmcloud, zellij, wizer, wash...
GHSA-C2F5-JXJV-2HH8 Wasmtime doesn't fully sandbox all the Windows device filenames
Impact Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so...
Wasmtime doesn't fully sandbox all the Windows device filenames
Impact Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so...
GHSA-C2F5-JXJV-2HH8 vulnerabilities
Vulnerabilities for packages: zed, wasmtime, wasmcloud, wizer, wash...
CVE-2024-51745
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...
DEBIAN-CVE-2024-51745
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...
CVE-2024-51756 vulnerabilities
Vulnerabilities for packages: zed, wasmtime, wasmcloud, zellij, wizer, wash...
CVE-2024-51745 vulnerabilities
Vulnerabilities for packages: zed, wasmtime, wasmcloud, wizer, wash...
CVE-2024-51745
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...
CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...
CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...
CVE-2024-51745
Wasmtime on Windows had a sandbox bypass where filenames with superscript digits (e.g., COM¹, LPT⁰) were not blocked, allowing untrusted Wasm code with filesystem access to reach devices and peripherals via special device filenames. Affected software: Wasmtime’s Windows filesystem sandbox. Root c...
CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...
CVE-2024-51745
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...