CVE-2022-43281: PYSEC-2022-43187 - wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size()

CVE-2022-43281 · Severity: low · CVSS 3.1 · Published 2022-10-28

Technologies: wabt (PyPI). Vendors: PyPI.

Executive brief

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.h.

Affected products

PyPI wabt

Related threats

PYSEC-2023-319 - WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.
PYSEC-2023-320 - WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.
PYSEC-2023-318 - WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.
PYSEC-2023-317 - WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.
PYSEC-2023-316 - WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.