Vulnerabilities > CVE-2019-7700 - Out-of-bounds Read vulnerability in Webassembly Binaryen

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

webassembly

CWE-125

NVD

Published: 2019-02-10

Updated: 2019-02-11

Summary

A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge.

Vulnerable Configurations

Part	Description	Count
Application	Webassembly Webassembly Binaryen 1 Webassembly Binaryen 1.38.22 Webassembly Binaryen 2 Webassembly Binaryen 3 Webassembly Binaryen 4 Webassembly Binaryen 5 Webassembly Binaryen 6 Webassembly Binaryen 7 Webassembly Binaryen 8 Webassembly Binaryen 9 Webassembly Binaryen 10 Webassembly Binaryen 11 Webassembly Binaryen 12 Webassembly Binaryen 13 Webassembly Binaryen 14 Webassembly Binaryen 15 Webassembly Binaryen 16 Webassembly Binaryen 17 Webassembly Binaryen 18 Webassembly Binaryen 19 Webassembly Binaryen 20 Webassembly Binaryen 21 Webassembly Binaryen 22 Webassembly Binaryen 23 Webassembly Binaryen 24 Webassembly Binaryen 25 Webassembly Binaryen 26 Webassembly Binaryen 27 Webassembly Binaryen 28 Webassembly Binaryen 29 Webassembly Binaryen 30 Webassembly Binaryen 31 Webassembly Binaryen 32 Webassembly Binaryen 33 Webassembly Binaryen 34 Webassembly Binaryen 35 Webassembly Binaryen 36 Webassembly Binaryen 37 Webassembly Binaryen 38 Webassembly Binaryen 39 Webassembly Binaryen 40 Webassembly Binaryen 41 Webassembly Binaryen 42 Webassembly Binaryen 43 Webassembly Binaryen 44 Webassembly Binaryen 45 Webassembly Binaryen 46 Webassembly Binaryen 47 Webassembly Binaryen 48 Webassembly Binaryen 49 Webassembly Binaryen 50 Webassembly Binaryen 51 Webassembly Binaryen 52 Webassembly Binaryen 53 Webassembly Binaryen 54 Webassembly Binaryen 55 Webassembly Binaryen 56 Webassembly Binaryen 57 Webassembly Binaryen 58 Webassembly Binaryen 59 Webassembly Binaryen 60 Webassembly Binaryen 61 Webassembly Binaryen 62 Webassembly Binaryen 63	64

Common Weakness Enumeration (CWE)

CWE-125 - Out-of-bounds Read

Common Attack Pattern Enumeration and Classification (CAPEC)

Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

References

https://github.com/WebAssembly/binaryen/issues/1864