cranelift-codegen (crates.io)
Advisories
11
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.93.1 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p cranelift-codegen --precise 0.93.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-xm67-587q-r2vw wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64 |
Medium EPSS 0.62% |
>= 0.88.0, < 0.91.1 | 0.91.1 |
| GHSA-xm67-587q-r2vw wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64 |
Medium EPSS 0.62% |
>= 0.93.0, < 0.93.1 | 0.93.1 |
| GHSA-xm67-587q-r2vw wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64 |
Medium EPSS 0.62% |
>= 0.92.0, < 0.92.1 | 0.92.1 |
| GHSA-ff4p-7xrq-q5r8 wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64 |
Critical EPSS 1.25% |
>= 0.84.0, < 0.91.1 | 0.91.1 |
| GHSA-ff4p-7xrq-q5r8 wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64 |
Critical EPSS 1.25% |
>= 0.92.0, < 0.92.1 | 0.92.1 |
| GHSA-ff4p-7xrq-q5r8 wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64 |
Critical EPSS 1.25% |
>= 0.93.0, < 0.93.1 | 0.93.1 |
| GHSA-5fhj-g3p3-pq9g Wasmtime vulnerable to Use After Free with `externref`s |
High EPSS 1.25% |
>= 0.84.0, < 0.85.2 | 0.85.2 |
| GHSA-jqwc-c49r-4w2x Miscompilation of `i8x16.swizzle` and `select` with v128 inputs |
Medium EPSS 1.79% |
< 0.85.1 | 0.85.1 |
| GHSA-7f6x-jwh5-m9r4 Cranelift vulnerable to miscompilation of constant values in division on AArch64 |
High EPSS 0.92% |
< 0.85.2 | 0.85.2 |
| RUSTSEC-2021-0067 Memory access due to code generation flaw in Cranelift module |
High EPSS 0.46% |
>= 0.0.0-0, < 0.73.1 | 0.73.1 |
| RUSTSEC-2021-0067 Memory access due to code generation flaw in Cranelift module |
High EPSS 0.46% |
< 0.73.1 | 0.73.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor