tocsin

CVE-2024-47763

3 advisories.

crates.io/wasmtime CVE-2024-47763: medium 5.5, EPSS 0.24%

wasmtime has a runtime crash when combining tail calls with trapping imports

Action: Upgrade wasmtime to 21.0.2 or later.

cargo update -p wasmtime --precise 21.0.2
cargo update -p wasmtime --precise 22.0.1
cargo update -p wasmtime --precise 23.0.3
cargo update -p wasmtime --precise 24.0.1
cargo update -p wasmtime --precise 25.0.2

Affected

introducedfixedlast affected
12.0.021.0.2-
22.0.022.0.1-
23.0.023.0.3-
24.0.024.0.1-
25.0.025.0.2-

Fixed versions

21.0.222.0.123.0.324.0.125.0.2

Sources

CVE-2024-47763 · published · modified · JSON

crates.io/wasmtime CVE-2024-47763: medium 5.5, EPSS 0.24%

Runtime crash when combining tail calls with stack traces

Action: Upgrade wasmtime to 21.0.2 or later.

cargo update -p wasmtime --precise 21.0.2
cargo update -p wasmtime --precise 22.0.1
cargo update -p wasmtime --precise 23.0.3
cargo update -p wasmtime --precise 24.0.1
cargo update -p wasmtime --precise 25.0.2

Affected

introducedfixedlast affected
21.0.021.0.2-
22.0.022.0.1-
23.0.023.0.3-
24.0.024.0.1-
25.0.025.0.2-

Fixed versions

21.0.222.0.123.0.324.0.125.0.2

Sources

CVE-2024-47763 · published · modified · JSON

PyPI/wasmtime-bin CVE-2024-47763: medium 5.5, EPSS 0.24%

Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The run

Action: No fix published. Pin and monitor.

Affected

introducedfixedlast affected
0-21.0.0

Fixed versions

No fixed version in the source.

Sources

CVE-2024-47763 · published · modified · JSON