Multiple Vulnerabilities in Wasmtime
* [Use after free passing `externref`s to Wasm in Wasmtime](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf) * [Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49) * [Wrong type for `Linker`-define functions when used across two `Engine`s](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx)
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-39218US | medium6.3 | — | ||
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an… | ||||
| CVE-2021-39219US | medium6.3 | — | ||
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clea… | ||||
| CVE-2021-39216US | low3.3 | — | ||
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from t… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://crates.io/crates/wasmtimePACKAGE
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49ADVISORY
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mxADVISORY
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xfADVISORY
- https://rustsec.org/advisories/RUSTSEC-2021-0110.htmlADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan