CVE-2019-7152: Medium severity webassembly binaryen vulnerability
A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-7152?
CVE-2019-7152 is a vulnerability in the Binaryen software library that allows for a heap-based buffer over-read, potentially leading to denial-of-service.
What is the severity of CVE-2019-7152?
CVE-2019-7152 has a severity rating of medium, with a CVSS score of 6.5.
How does CVE-2019-7152 affect Webassembly Binaryen?
CVE-2019-7152 affects Webassembly Binaryen up to version 1.38.22, potentially leading to denial-of-service due to segmentation faults caused by a crafted input.
How can the CVE-2019-7152 vulnerability be exploited?
The CVE-2019-7152 vulnerability can be exploited by providing a specifically crafted input, causing the wasm::WasmBinaryBuilder::processFunctions() function in wasm/wasm-binary.cpp to read past the end of the allocated buffer.
Is there a fix available for CVE-2019-7152?
To mitigate the CVE-2019-7152 vulnerability, it is recommended to update Webassembly Binaryen to a version above 1.38.22.