Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

cranelift-codegen

7 known vulnerabilities (1 critical, 1 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 critical, 1 high, 4 medium, 1 low
Registry
crates.io

Advisories 7

  • CVE-2023-26489Critical 10.0

    Guest-controlled out-of-bounds read/write on x86_64 in wasmtime

    Affected: from 0.84.0, fixed in 0.91.1; from 0.92.0, fixed in 0.92.1; from 0.93.0, fixed in 0.93.1.

  • wasmtime is a fast and secure runtime for WebAssembly.

    Affected: from 0.88.0, fixed in 0.91.1; from 0.92.0, fixed in 0.92.1; from 0.93.0, fixed in 0.93.1.

  • CVE-2022-31169Medium 5.9

    Cranelift vulnerable to miscompilation of constant values in division on AArch64

    Affected: fixed in 0.85.2.

  • CVE-2022-31146Medium 6.4

    Use After Free in Wasmtime

    Affected: from 0.84.0, fixed in 0.85.2.

  • CVE-2022-31104Medium 4.8

    Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime

    Affected: fixed in 0.85.1.

  • CVE-2022-23636Medium 5.1

    Invalid drop of partially-initialized instances in wasmtime

    Affected: fixed in 0.85.2.

  • Memory access due to code generation flaw in Cranelift module

    Affected: fixed in 0.73.1; fixed in 0.73.1.