rust-wasmtime vulnerabilities (Debian)
38 vulnerabilities.
-
rust-wasmtimeDebian Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction 9.9 Critical -
rust-wasmtimeDebian Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation 9.9 Critical -
rust-wasmtimeDebian Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles 6.9 Medium -
rust-wasmtimeDebian Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling 2.1 Low -
rust-wasmtimeDebian Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename 8.8 High -
rust-wasmtimeDebian Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir 2.1 Low -
rust-wasmtimeDebian Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes 5.9 Medium -
rust-wasmtimeDebian Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff 5.1 Medium -
rust-wasmtimeDebian Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API 1.0 Low -
rust-wasmtimeDebian Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow 6.9 Medium -
rust-wasmtimeDebian Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes 8.8 High -
rust-wasmtimeDebian Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion 1.0 Low -
rust-wasmtimeDebian Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination 6.5 Medium -
rust-wasmtimeDebian Wasmtime: Leak in WASIp1 `fd_renumber` implementation 2.3 Low -
rust-wasmtimeDebian Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction 7.5 High -
rust-wasmtimeDebian Wasmtime: Panic when allocating a table exceeding the size of the host's address space 5.9 Medium -
rust-wasmtimeDebian Wasmtime has an out-of-bounds write or crash when transcoding component model strings 6.1 Medium -
rust-wasmtimeDebian Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend 6.1 Medium -
rust-wasmtimeDebian Wasmtime leaks data between pooling allocator instances 2.3 Low -
rust-wasmtimeDebian Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access 9.0 Critical -
rust-wasmtimeDebian Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` 1.0 Low -
rust-wasmtimeDebian Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift 9.0 Critical -
rust-wasmtimeDebian Wasmtime's host panics when Winch compiler executes `table.fill` 5.9 Medium -
rust-wasmtimeDebian Wasmtime leaks host data with 64-bit tables and Winch 2.3 Low -
rust-wasmtimeDebian Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 4.1 Medium -
rust-wasmtimeDebian Wasmtime panics when lifting `flags` component value 5.6 Medium -
rust-wasmtimeDebian Wasmtime panics when transcoding misaligned utf-16 strings 5.9 Medium -
rust-wasmtimeDebian Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding 6.9 Medium -
rust-wasmtimeDebian Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance 6.9 Medium -
rust-wasmtimeDebian Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion 6.9 Medium -
rust-wasmtimeDebian Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 4.1 Medium -
rust-wasmtimeDebian Wasmtime provides unsound API access to a WebAssembly shared linear memory 1.8 Low -
rust-wasmtimeDebian Wasmtime has host panic with `fd_renumber` WASIp1 function 3.5 Low -
rust-wasmtimeDebian Wasmtime doesn't fully sandbox all the Windows device filenames 2.3 Low -
rust-wasmtimeDebian Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations 2.9 Low -
rust-wasmtimeDebian Wasmtime runtime crash when combining tail calls with trapping imports 5.5 Medium -
rust-wasmtimeDebian Wasmtime vulnerable to panic when using a dropped extenref-typed element segment 3.3 Low -
rust-wasmtimeDebian Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64 2.2 Low