CVE-2019-15759 Null dereference in n/a

Medium 6.5 Published 29 Aug 2019 Updated 5 Aug 2024

A crafted input can cause a segmentation fault in Binaryen, leading to denial of service for applications using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-15759?

CVE-2019-15759 is a medium-severity vulnerability in n/a, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.

Weakness: CWE-476

Which versions are affected by CVE-2019-15759?

It affects 1 product.

Products include Webassembly Binaryen.

How do I fix CVE-2019-15759?

Upgrade to a fixed version.

Is CVE-2019-15759 being exploited?

There is no known exploitation of CVE-2019-15759 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-15759, GHSA-w872-v6x7-99f4.