CVE-2019-15759

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/WebAssembly/binaryen/issues/2288Exploit, Patch, Third Party Advisory
https://github.com/WebAssembly/binaryen/pull/2289Patch, Third Party Advisory
https://github.com/WebAssembly/binaryen/issues/2288Exploit, Patch, Third Party Advisory
https://github.com/WebAssembly/binaryen/pull/2289Patch, Third Party Advisory

Timeline

Published: Aug 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-15768.8Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentiall CVE-2019-157668.8The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJA CVE-2019-157677.8In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EP CVE-2019-157698.8The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.CVE-2019-15776.3Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScrip CVE-2019-157708.8The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.CVE-2019-157716.1The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157726.1The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157736.1The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157746.1The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157756.1The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157766.1The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a C