CVE catalog

CVE-2019-7152

binaryen: CVE-2019-7152

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.15% · Oct 25, 2026

A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbinaryensid131-2fixed
Debianbinaryenforky131-2fixed
Debianbinaryentrixie120-4fixed
Debianbinaryenbookworm108-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbinaryensourcesid66-1not yet assignedNot reported[920853]
Debianbinaryensourceforky66-1not yet assignedNot reported[920853]
Debianbinaryensourcetrixie66-1not yet assignedNot reported[920853]
Debianbinaryensourcebookworm66-1not yet assignedNot reported[920853]

[Debian bug #920853]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [binaryen]Fixed
    Details (2)

    • 108-1 · amd64 · bookworm

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · bookworm; dsa · binaryen · debian · 12

    • 108-1 · arm64 · bookworm

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · bookworm; dsa · binaryen · debian · 12

[Debian 13 (Trixie)]

  • [binaryen]Fixed
    Details (2)

    • 120-4 · amd64 · trixie

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · 13

    • 120-4 · arm64 · trixie

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]