CVE catalog

CVE-2019-7154

binaryen: CVE-2019-7154

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.12% · Oct 25, 2026

The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbinaryensid131-2fixed
Debianbinaryenforky131-2fixed
Debianbinaryentrixie120-4fixed
Debianbinaryenbookworm108-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbinaryensourcesid66-1not yet assignedNot reported[920853]
Debianbinaryensourceforky66-1not yet assignedNot reported[920853]
Debianbinaryensourcetrixie66-1not yet assignedNot reported[920853]
Debianbinaryensourcebookworm66-1not yet assignedNot reported[920853]

[Debian bug #920853]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [binaryen]Fixed
    Details (2)

    • 108-1 · amd64 · bookworm

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · bookworm; dsa · binaryen · debian · 12

    • 108-1 · arm64 · bookworm

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · bookworm; dsa · binaryen · debian · 12

[Debian 13 (Trixie)]

  • [binaryen]Fixed
    Details (2)

    • 120-4 · amd64 · trixie

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · 13

    • 120-4 · arm64 · trixie

      Fixed · Fixed: 66-1

      dsa · binaryen · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]