Your message dated Tue, 06 Oct 2026 20:49:22 +0000
with message-id <[email protected]>
and subject line Bug#1150156: fixed in wabt 1.0.42+dfsg+~cs1.0.39-2
has caused the Debian Bug report #1150156,
regarding wabt: CVE-2026-90648
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150156: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150156
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: wabt
Version: 1.0.41+dfsg+~cs1.0.39-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/WebAssembly/wabt/issues/2831
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for wabt.
CVE-2026-90648[0]:
| wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in
| some situations that primarily involve 32-bit platforms, aka a
| "table flip" attack. It does not check the return value of calloc()
| in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-
| tableops.inc). When the funcref table allocation fails, table->data
| is left NULL while table->size keeps the guest-declared element
| count; thus, bounds checks still pass and table element accesses
| resolve to absolute memory addresses (i *
| sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of
| host process memory and - via table.get, table.set, and
| call_indirect - arbitrary code execution, defeating the isolation
| that wasm2c exists to provide (a full sandbox escape). wasm2c is
| used as an in-process sandboxing boundary by RLBox and WasmBoxC,
| including in Firefox, which compiles the Graphite, Hunspell, Ogg,
| Expat, and Woff2 libraries via wasm2c to contain untrusted font,
| media, and XML input. Therefore, sandboxing in these applications is
| potentially affected. Exploitation requires the funcref table
| allocation to fail, for example under an address-space limit
| (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under
| memory pressure. On 64-bit Linux with default overcommit the
| allocation succeeds and the defect is not triggered. The wasm2c
| memory allocator aborts on calloc failure in the same runtime; the
| table allocator lacks this abort behavior. This was introduced in
| commit ab9e0b55 (PR #813).
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-90648
https://www.cve.org/CVERecord?id=CVE-2026-90648
[1] https://github.com/WebAssembly/wabt/issues/2831
[2] https://github.com/WebAssembly/wabt/issues/2854
[3]
https://github.com/WebAssembly/wabt/commit/e197d0b7bd3fe426f5963ae540f4426a1d49e89f
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: wabt
Source-Version: 1.0.42+dfsg+~cs1.0.39-2
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wabt, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated wabt package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 06 Oct 2026 22:34:13 +0200
Source: wabt
Architecture: source
Version: 1.0.42+dfsg+~cs1.0.39-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1150156
Changes:
wabt (1.0.42+dfsg+~cs1.0.39-2) unstable; urgency=medium
.
* Team upload
* Declare compliance with policy 4.7.4
* Drop "Rules-Requires-Root: no"
* Drop "Priority: optional"
* debian/watch version 5
* Add upstream patch to fail closed when wasm2c table allocation fails
(1.0.42 did not include the fix) (Closes: #1150156, CVE-2026-90648)
Checksums-Sha1:
89d253afef5bac77b15ae9f158ac25de2e429a09 2448 wabt_1.0.42+dfsg+~cs1.0.39-2.dsc
f37d764298d972eaaf8809d2c1741315fe68b2e7 15344
wabt_1.0.42+dfsg+~cs1.0.39-2.debian.tar.xz
Checksums-Sha256:
1638d65230077f2c43283bb973bd9074f4d5dafd73320213149b4739eb78c1da 2448
wabt_1.0.42+dfsg+~cs1.0.39-2.dsc
83fe184c5b2415a78aed6986bbfd27155976e5b10bc5c3776c29a087e502efb8 15344
wabt_1.0.42+dfsg+~cs1.0.39-2.debian.tar.xz
Files:
02b40125baa0e840b07a4bd5fd5b550d 2448 devel optional
wabt_1.0.42+dfsg+~cs1.0.39-2.dsc
1c95742a1e14ba4f39dd360cd864c8a5 15344 devel optional
wabt_1.0.42+dfsg+~cs1.0.39-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrFXFoACgkQ9tdMp8mZ
7ukuNA/5AW8QQIFwPxBQSteG/r/geHJUovHkRq1b8Ww8zjPWqAayCarKj49Z0GzG
MnyVW1v65z+hyYTkpmFI7PO5kj1ONYxFlzgOsT1replZcIHXTXa1W8BMWcrU98d0
nw4Qi7lnTDwES/v/vsh5OrYcehzfTf/97pRrYT2L6S9DLhB+RqSmg9EgB25sRH2w
Auh5jZ+99WQ6gvcP8B0hbAKTgmWc03F3VB56nyCXMdU1oCRODIJZ+/NVXYY8YU41
SCLWA959URyRAT5uZnYS/21ohqGl8rIEIddTLssh5Z69K2GwsoLm899rsyqqJj7p
BozZcG8lUDcHdQ3+FSt+c36F8bqg1U1r15cGs4jdBUt1fR90vv2r3h8S5w5EyrbF
PU+49TbP2Bx851w/zyOCu9YCY7zDVbjP1ViYbPdMz+uSB7HX3MJD//JmU1Bem6CB
w6me80FYc2RNZBme/tJVy1FtfDNs/XUXDSrvsLseGxJ/UtwJ7mgDf8jsR44JdJCJ
a1BiOMW46OlaZUK7EkloxVVC2+NHCG+tbSZQNU3YQ1zV/D7Lb0pwfUdwNbzRM4aH
Md6pRHHM1jAP50YAFwyhEZmJhoyCvLs0ysCtLDxuvy49LBMFXZGBbbd0ADjR29pL
3WbrCzTdSYZsluFYb1/kM4drHrZi/ESaIDgStIuo4d+YY0xxK4U=
=s6zc
-----END PGP SIGNATURE-----
pgpb9EnORxtND.pgp
Description: PGP signature
--- End Message ---
