CVE-2021-45293 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Binaryen

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

0.2%

top 60.89%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Webassembly Binaryen Debian Binaryen Fedoraproject Fedora

Timeline

PublishedDec 21

Latest updateDec 22

Description

A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/binaryen< binaryen 104-1 (bookworm)

▶Debianwebassembly/binaryen< 104-1+2

▶NVDwebassembly/binaryen103

Also affects: Fedora 34, 35

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

GHSA-mcjm-q5m8-3xx2: A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet↗2021-12-22

▶

OSV

CVE-2021-45293: A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet↗2021-12-21

▶

📋Vendor Advisories

Debian

CVE-2021-45293: binaryen - A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memor...↗2021

▶