CVE-2018-17293 An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input....
HighCVSS 8.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webassembly virtual machine project webassembly virtual machine | < 2018-09-16 | 2018-09-16 |
References
- github.com patch third-party-advisory
- github.com exploit patch third-party-advisory