Vulnerability-Lookup

GHSA-HF6R-R2HJ-F2G7

Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2025-10-22 00:32

Details

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-21193"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-16T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
  "id": "GHSA-hf6r-r2hj-f2g7",
  "modified": "2025-10-22T00:32:04Z",
  "published": "2022-05-24T17:44:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21193"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1186287"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N52OWF4BAP3JNK2QYGU3Q6QUVDZDCIMQ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N52OWF4BAP3JNK2QYGU3Q6QUVDZDCIMQ"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202104-08"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21193"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2021/dsa-4886"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HF6V-5V9G-C7Q6

Vulnerability from github – Published: 2022-11-30 00:30 – Updated: 2022-12-02 00:30

Details

Use after free in Forms in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-4181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-30T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Forms in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-hf6v-5v9g-c7q6",
  "modified": "2022-12-02T00:30:24Z",
  "published": "2022-11-30T00:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4181"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1382581"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-10"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202311-11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HF79-8HJP-RRVQ

Vulnerability from github – Published: 2021-11-30 22:20 – Updated: 2026-01-20 19:01

Summary

Use After Free in lucet

Details

Impact

There is a bug in the main branch of Lucet's lucet-runtime that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Instance is dropped.

Patches

Users should upgrade to the main branch of the Lucet repository. Lucet does not provide versioned releases on crates.io.

Workarounds

There is no way to remediate this vulnerability without upgrading.

Description

Lucet uses a "pool" allocator for new WebAssembly instances that are created. This pool allocator manages everything from the linear memory of the wasm instance, the runtime stack for async switching, as well as the memory behind the Instance itself. Instances are referred to via an InstanceHandle type which will, on drop, release the memory backing the Instance back to the pool.

When an Instance is dropped, the fields of the Instance are destructed top-to-bottom, however when the alloc: Alloc field is destructed, the memory backing the Instance is released back to the pool before the destructors of the remaining fields are run. If another thread allocates the same memory from the pool while these destructors are still running, a race condition occurs that can lead to use-after-free errors.

The bug was corrected by changing how the InstanceHandle destructor operates to ensure that the memory backing an Instance is only returned to the pool once the Instance has been completely destroyed.

This security advisory has been assigned CVE-2021-43790.

For more information

If you have any questions or comments about this advisory: * Open an issue in lucet repository * Email the lucet team * See the Bytecode Alliance security policy

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "lucet-runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-43790"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-30T20:56:59Z",
    "nvd_published_at": "2021-11-30T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThere is a bug in the main branch of Lucet\u0027s `lucet-runtime` that allows a use-after-free in an `Instance` object that could result in memory corruption, data race, or other related issues.  This bug was introduced early in the development of Lucet and is present in all releases.  As a result of this bug, and dependent on the memory backing for the `Instance` objects, it is possible to trigger a use-after-free when the `Instance` is dropped.\n\n### Patches\nUsers should upgrade to the `main` branch of the Lucet repository. Lucet does not provide versioned releases on crates.io.\n\n### Workarounds\nThere is no way to remediate this vulnerability without upgrading.\n\n### Description\nLucet uses a \"pool\" allocator for new WebAssembly instances that are created. This pool allocator manages everything from the linear memory of the wasm instance, the runtime stack for async switching, as well as the memory behind the Instance itself. `Instances` are referred to via an `InstanceHandle` type which will, on drop, release the memory backing the Instance back to the pool.\n\nWhen an Instance is dropped, the fields of the `Instance` are destructed top-to-bottom, however when the `alloc: Alloc` field is destructed, the memory backing the `Instance` is released back to the pool before the destructors of the remaining fields are run. If another thread allocates the same memory from the pool while these destructors are still running, a race condition occurs that can lead to use-after-free errors.\n\nThe bug was corrected by changing how the `InstanceHandle` destructor operates to ensure that the memory backing an Instance is only returned to the pool once the `Instance` has been completely destroyed.\n\nThis security advisory has been assigned CVE-2021-43790.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [lucet repository](https://github.com/bytecodealliance/lucet)\n* Email [the lucet team](mailto:lucet@fastly.com)\n* See the [Bytecode Alliance security policy](https://bytecodealliance.org/security)",
  "id": "GHSA-hf79-8hjp-rrvq",
  "modified": "2026-01-20T19:01:17Z",
  "published": "2021-11-30T22:20:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/lucet/security/advisories/GHSA-hf79-8hjp-rrvq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43790"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/lucet/commit/7c7757c772fb709c61b1442bcc1e1fbee97bf4a8"
    },
    {
      "type": "WEB",
      "url": "https://crates.io/crates/lucet-runtime"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytecodealliance/lucet"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0155.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Use After Free in lucet"
}

GHSA-HFC9-8F4J-8V94

Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26

Details

Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "document script lifetime handling."

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2011-1195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-03-11T02:01:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to \"document script lifetime handling.\"",
  "id": "GHSA-hfc9-8f4j-8v94",
  "modified": "2022-05-13T01:26:05Z",
  "published": "2022-05-13T01:26:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1195"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65959"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14575"
    },
    {
      "type": "WEB",
      "url": "http://code.google.com/p/chromium/issues/detail?id=71763"
    },
    {
      "type": "WEB",
      "url": "http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/46785"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/0628"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-HFCH-73VM-JX9G

Vulnerability from github – Published: 2022-05-14 03:47 – Updated: 2022-05-14 03:47

Details

Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.

Severity

5.5 (Medium)


                  
                    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-3471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-01-12T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.",
  "id": "GHSA-hfch-73vm-jx9g",
  "modified": "2022-05-14T03:47:38Z",
  "published": "2022-05-14T03:47:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3471"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112271"
    },
    {
      "type": "WEB",
      "url": "https://lists.gnu.org/archive/html/qemu-devel/2014-06/msg05283.html"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-201412-01.xml"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/06/23/4"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/68145"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HFM6-8RW8-XWH8

Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2022-05-13 01:24

Details

Use-after-free vulnerability in the TableBackgroundPainter::TableBackgroundData::Destroy function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an HTML document with a table containing many columns and column groups.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-0744"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-01-13T20:55:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in the TableBackgroundPainter::TableBackgroundData::Destroy function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an HTML document with a table containing many columns and column groups.",
  "id": "GHSA-hfm6-8rw8-xwh8",
  "modified": "2022-05-13T01:24:35Z",
  "published": "2022-05-13T01:24:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0744"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=814713"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17007"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0144.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0145.html"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-05.html"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-1681-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-1681-2"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-1681-4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-HFP4-4377-7CC7

Vulnerability from github – Published: 2022-05-24 17:20 – Updated: 2022-05-24 17:20

Details

Adobe Flash Player versions 32.0.0.371 and earlier, 32.0.0.371 and earlier, and 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-9633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-12T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "Adobe Flash Player versions 32.0.0.371 and earlier, 32.0.0.371 and earlier, and 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.",
  "id": "GHSA-hfp4-4377-7cc7",
  "modified": "2022-05-24T17:20:24Z",
  "published": "2022-05-24T17:20:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9633"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/flash-player/apsb20-30.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202006-09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-HFR4-7C6C-48W2

Vulnerability from github – Published: 2026-04-09 20:23 – Updated: 2026-06-08 20:00

Summary

Wasmtime has use-after-free bug after cloning `wasmtime::Linker`

Details

Impact

In version 43.0.0 of the wasmtime crate, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs.

This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host.

The typical symptom of this use-after-free bug is a segfault. It does not enable heap corruption or data leakage.

If you are using the wasmtime CLI, rather than the embedding API, you are not affected. If you are using the embedding API but are not calling wasmtime::Linker's Clone implementation, you are not affected.

Specifically, the following steps must occur to trigger the bug:

Clone a wasmtime::Linker
Drop the original linker instance
Use the new, cloned linker instance, resulting in a use-after-free

Patches

This bug has been patched in Wasmtime version 43.0.1

Workarounds

Wasmtime embedders are highly encouraged to upgrade their wasmtime crate dependency.

If upgrading is not an option, or as a temporary workaround before upgrading, you can avoid this bug by not cloning wasmtime::Linker and instead creating a new, empty wasmtime::Linker and manually reregistering the host APIs from the original linker:

use wasmtime::{Linker, Result, Store};

fn clone_linker<T>(linker: &Linker<T>, store: &mut Store<T>) -> Result<Linker<T>> {
    let mut cloned = Linker::new();
    for (module, name, item) in linker.iter(store) {
        cloned.define(module, name, item)?;
    }
    Ok(cloned)
}

References

This bug was introduced during an internal refactoring that was part of our efforts to robustly handle allocation failure in Wasmtime. This refactoring introduced an string-interning pool which had an unsound TryClone[^try-clone] implementation.

[^try-clone]: The TryClone trait is our version of the Rust standard library's Clone trait that allows for returning OutOfMemory errors.

The StringPool was introduced in https://github.com/bytecodealliance/wasmtime/pull/12536, at which time the bug in TryClone for StringPool was already present, although this code path was not yet used anywhere.
wasmtime::Linker was refactored to internally use StringPool in https://github.com/bytecodealliance/wasmtime/pull/12537, at which time the buggy code path became accessible.
This bug was originally reported to the Wasmtime maintainers as https://github.com/bytecodealliance/wasmtime/pull/12906

Severity

1.0 (Low)


                  
                    CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "43.0.0"
            },
            {
              "fixed": "43.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "43.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34983"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-09T20:23:44Z",
    "nvd_published_at": "2026-04-09T19:16:24Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nIn version 43.0.0 of the `wasmtime` crate, cloning a `wasmtime::Linker` is unsound and can result in use-after-free bugs.\n\nThis bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host.\n\nThe typical symptom of this use-after-free bug is a segfault. It does not enable heap corruption or data leakage.\n\nIf you are using the `wasmtime` CLI, rather than the embedding API, you are not affected. If you are using the embedding API but are not calling `wasmtime::Linker`\u0027s `Clone` implementation, you are not affected.\n\nSpecifically, the following steps must occur to trigger the bug:\n\n* Clone a `wasmtime::Linker`\n* Drop the original linker instance\n* Use the new, cloned linker instance, resulting in a use-after-free\n\n### Patches\n\nThis bug has been patched in Wasmtime version 43.0.1\n\n### Workarounds\n\nWasmtime embedders are highly encouraged to upgrade their `wasmtime` crate dependency.\n\nIf upgrading is not an option, or as a temporary workaround before upgrading, you can avoid this bug by not cloning `wasmtime::Linker` and instead creating a new, empty `wasmtime::Linker` and manually reregistering the host APIs from the original linker:\n\n```rust\nuse wasmtime::{Linker, Result, Store};\n\nfn clone_linker\u003cT\u003e(linker: \u0026Linker\u003cT\u003e, store: \u0026mut Store\u003cT\u003e) -\u003e Result\u003cLinker\u003cT\u003e\u003e {\n    let mut cloned = Linker::new();\n    for (module, name, item) in linker.iter(store) {\n        cloned.define(module, name, item)?;\n    }\n    Ok(cloned)\n}\n```\n\n### References\n\nThis bug was introduced during an internal refactoring that was part of our efforts to [robustly handle allocation failure in Wasmtime](https://github.com/bytecodealliance/wasmtime/issues/12069). This refactoring introduced an string-interning pool which had an unsound `TryClone`[^try-clone] implementation.\n\n[^try-clone]: [The `TryClone` trait](https://github.com/bytecodealliance/wasmtime/blob/33e8b3d955697587b23cf39d87fbcbdb4d26b0c9/crates/core/src/alloc/try_clone.rs#L5-L17) is our version of the Rust standard library\u0027s `Clone` trait that allows for returning `OutOfMemory` errors.\n\n* The `StringPool` was introduced in https://github.com/bytecodealliance/wasmtime/pull/12536, at which time the bug in `TryClone for StringPool` was already present, although this code path was not yet used anywhere.\n* `wasmtime::Linker` was refactored to internally use `StringPool` in https://github.com/bytecodealliance/wasmtime/pull/12537, at which time the buggy code path became accessible.\n* This bug was originally reported to the Wasmtime maintainers as https://github.com/bytecodealliance/wasmtime/pull/12906",
  "id": "GHSA-hfr4-7c6c-48w2",
  "modified": "2026-06-08T20:00:38Z",
  "published": "2026-04-09T20:23:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34983"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytecodealliance/wasmtime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2026-151.yaml"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0090.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Wasmtime has use-after-free bug after cloning `wasmtime::Linker`"
}

GHSA-HFVW-FPHH-WH3W

Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2022-10-13 19:00

Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8163.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-6767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-03T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8163.",
  "id": "GHSA-hfvw-fphh-wh3w",
  "modified": "2022-10-13T19:00:16Z",
  "published": "2022-05-24T16:47:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6767"
    },
    {
      "type": "WEB",
      "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-441"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HFXQ-2WFW-XHV2

Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25

Details

Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG animations.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2010-4492"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-12-07T21:00:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG animations.",
  "id": "GHSA-hfxq-2wfw-xhv2",
  "modified": "2022-05-13T01:25:02Z",
  "published": "2022-05-13T01:25:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4492"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11475"
    },
    {
      "type": "WEB",
      "url": "http://code.google.com/p/chromium/issues/detail?id=62401"
    },
    {
      "type": "WEB",
      "url": "http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/42472"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2011/dsa-2188"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CWE-416

Use After Free

GHSA-HF6R-R2HJ-F2G7

GHSA-HF6V-5V9G-C7Q6

GHSA-HF79-8HJP-RRVQ

Impact

Patches

Workarounds

Description

For more information

GHSA-HFC9-8F4J-8V94

GHSA-HFCH-73VM-JX9G

GHSA-HFM6-8RW8-XWH8

GHSA-HFP4-4377-7CC7

GHSA-HFR4-7C6C-48W2

Impact

Patches

Workarounds

References

GHSA-HFVW-FPHH-WH3W

GHSA-HFXQ-2WFW-XHV2

Mitigation

Mitigation