CVE-2018-17293

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-17293

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17293.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-17293

Published

2018-09-21T07:29:00.457Z

Modified

2026-04-11T11:39:42.669882Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.

References

Affected packages

Git / github.com/wavm/wavm

Affected ranges

Type: GIT
Repo: https://github.com/wavm/wavm
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

31d670b6489e6d708c3b04b911cdf14ac43d846d

Type: GIT
Repo: https://github.com/wavm/wavm
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

31d670b6489e6d708c3b04b911cdf14ac43d846d

Database specific

vanir_signatures_modified

"2026-04-11T11:39:42Z"

vanir_signatures

[
    {
        "id": "CVE-2018-17293-766f067d",
        "target": {
            "file": "Programs/wavm/wavm.cpp",
            "function": "run"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "223932303632993575063340708268581817075",
            "length": 4326.0
        },
        "signature_type": "Function",
        "source": "https://github.com/wavm/wavm/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2018-17293-e2dafb4d",
        "target": {
            "file": "Programs/wavm/wavm.cpp"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "320000027779525796497406571864261378643",
                "303074121024348770067694516215010702859",
                "268723876264344264401013688696891683322",
                "236585774404262886715641904444378310444",
                "15634736109366250920333150109281842371",
                "290360243184211282883699885563560318450",
                "99430604633758981177210224798224771874",
                "252631172378521555520088269925526948874",
                "221739687104665159201932448089760617918",
                "11689498126797467117947311927530697942",
                "232930766379943851720026101142798233878",
                "30913155390947140618337544289044782842",
                "247461309769800258306856029146493917756",
                "149880145767215881798272913643206570567",
                "134623929401584405153413446138726944604",
                "106271611649610550535499272594076420952"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/wavm/wavm/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17293.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2018-09-16"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2018-09-16"
            }
        ]
    }
]