Page MenuHomeFreeBSD
Files F177535401

D60941.1794652628.diff
No OneTemporary
Actions

Authored By
Unknown
Size
4 KB
Referenced Files
None
Subscribers
None

D60941.1794652628.diff
View Options

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,85 @@
+ <vuln vid="57e6e702-cd69-11f1-b0e3-74563cf85f9d">
+ <topic>libwasmtime -- Multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>libwasmtime</name>
+ <name>wasmtime</name>
+ <range><lt>36.0.19</lt></range>
+ <range><ge>37.0.0</ge><lt>48.0.7</lt></range>
+ <range><ge>49.0.0</ge><lt>49.0.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Wasmtime development team reports:</p>
+ <blockquote cite="https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.3">
+ <ul>
+ <li>Out-of-bounds zero-length stream writes can panic.</li>
+ <li>Host panic when component call_async is cancelled under some
+ conditions.</li>
+ <li>Panic on erroneous call-to-host from guest realloc call.</li>
+ <li>Yielding in a component start function can lead to a host panic.</li>
+ <li>Panic when invoking an async-lifted function via call.</li>
+ <li>Panic when pending calls are run after a trap.</li>
+ <li>Stack overflow dropping a long chain of recursive types.</li>
+ <li>Wasmtime may not properly enforce async-entrypoint requirement.</li>
+ <li>Panic viewing component model stream or future as the wrong
+ type.</li>
+ <li>Component-model handle tables are capped only per instance and
+ charged to no limit.</li>
+ <li>Exception tags can cause host data structures to be unaligned.</li>
+ <li>Filesystem sandbox escape when renaming symlinks with trailing
+ slashes.</li>
+ <li>Overlapping string transcode in a fused adapter can panic.</li>
+ <li>Guests can send absolute-form HTTP requests to different hosts.</li>
+ <li>wasi-http: Request with long url before query parameter crashes
+ host.</li>
+ </ul>
+ </blockquote>
+ <blockquote cite="https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4">
+ <ul>
+ <li>wasi-http: Guests can add conflicting content lengths to
+ messages</li>
+ <li>wasi-http p3: forwarded trailers aren't checked against
+ is_forbidden_header hook</li>
+ <li>wasi-http p3: Guests can set incorrect content-length for
+ spliced response bodies</li>
+ <li>Cranelift backend on aarch64 can jump to incorrect target on
+ large Wasm br_table instruction</li>
+ <li>Panic lowering a host-created component model stream into a
+ guest that expects a different payload type.</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9prg-84vf-g5fc</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm</url>
+ <url>https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5</url>
+ </references>
+ <dates>
+ <discovery>2026-10-14</discovery>
+ <entry>2026-10-21</entry>
+ </dates>
+ </vuln>
+
<vuln vid="1701e8a6-cd43-11f1-8135-8447094a420f">
<topic>PowerDNS -- Multiple vulnerabilities</topic>
<affects>

File Metadata

Mime Type
text/plain
Expires
Sat, Nov 14, 10:37 AM (5 h, 3 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41209300
Default Alt Text
D60941.1794652628.diff (4 KB)

Event Timeline