Webassembly Binaryen vulnerabilities

CVE-2019-7152 [MEDIUM] CWE-125 CVE-2019-7152: A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/ A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.

CVE-2019-7151 [MEDIUM] CWE-476 CVE-2019-7151: A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Bin A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.

CVE-2019-7153 [MEDIUM] CWE-476 CVE-2019-7153: A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/was A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.

CVE-2019-7154 [MEDIUM] CWE-787 CVE-2019-7154: The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.