CVE catalog

CVE-2019-15759

binaryen: CVE-2019-15759

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
1.25% · Oct 25, 2026

An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbinaryensid131-2fixed
Debianbinaryenforky131-2fixed
Debianbinaryentrixie120-4fixed
Debianbinaryenbookworm108-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbinaryensourcesid89-1unimportantNot reported[936024]
Debianbinaryensourceforky89-1unimportantNot reported[936024]
Debianbinaryensourcetrixie89-1unimportantNot reported[936024]
Debianbinaryensourcebookworm89-1unimportantNot reported[936024]

[Debian bug #936024]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [binaryen]Fixed
    Details (2)

    • 108-1 · amd64 · bookworm

      Fixed · Fixed: 89-1

      dsa · binaryen · debian · bookworm; dsa · binaryen · debian · 12

    • 108-1 · arm64 · bookworm

      Fixed · Fixed: 89-1

      dsa · binaryen · debian · bookworm; dsa · binaryen · debian · 12

[Debian 13 (Trixie)]

  • [binaryen]Fixed
    Details (2)

    • 120-4 · amd64 · trixie

      Fixed · Fixed: 89-1

      dsa · binaryen · debian · 13

    • 120-4 · arm64 · trixie

      Fixed · Fixed: 89-1

      dsa · binaryen · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]