PT-2022-19331 · Wasm3 · Wasm3

Zu1Ko · Published 2022-04-16 · Updated 2022-04-26 · CVE-2022-28966

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wasm3 version 0.5.0

Description The issue is a heap-based buffer overflow in the NewCodePage function in m3 code.c, which is called indirectly from the Compile BranchTable function in m3 compile.c.

Recommendations For Wasm3 version 0.5.0, consider disabling the NewCodePage function or restricting access to the Compile BranchTable function in m3 compile.c until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-28966

Affected Products

Wasm3

References · 4

• 🔥 https://github.com/wasm3/wasm3/issues/320 · Exploit
• https://osv.dev/vulnerability/CVE-2022-28966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28966 · Security Note
• https://t.me/cvenotify/29072 · Telegram Post