Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32613 State: PUBLISHED Published: 2021-05-14T12:11:40 Last Updated: 2024-08-03T23:25:30.599Z Vendors: n/a Products: radare2 Problem Types: CWE-416 Description: In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1959939 - https://github.com/radareorg/radare2/issues/18679 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3LPB5VGCIA7WA55FSB3YZQFUGZKWD7O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y
55FSB3YZQFUGZKWD7O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3S7JB46PONPHXZHIMR2XDPLGJCN5ZIX/ - https://github.com/radareorg/radare2/issues/18667 - https://github.com/radareorg/radare2/commit/a07dedb804a82bc01c07072861942dd80c6b6d62 - https://github.com/radareorg/radare2/issues/18666 - https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05
CVE ID: CVE-2021-32614 State: PUBLISHED Published: 2021-05-26T21:42:35 Last Updated: 2024-08-03T23:25:30.625Z Vendors: n/a Products: dmg2img Problem Types: CWE-125 Description: A flaw was found in dmg2img through 20170502. fill_mishblk() does not check the length of the read buffer, and copy 0xCC bytes from it. The length of the buffer is controlled by an attacker. By providing a length smaller than 0xCC, memcpy reaches out of the malloc'ed bound. This possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show
reach code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1959911
CVE ID: CVE-2021-32615 State: PUBLISHED Published: 2021-05-13T22:07:29 Last Updated: 2024-08-03T23:25:30.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/commit/2ce1e5952238eba0fe5c5d6537ebdc76cb970b52 - https://github.com/Piwigo/Piwigo/issues/1410
CVE ID: CVE-2021-32616 State: PUBLISHED Published: 2021-05-28T20:20:17 Last Updated: 2024-08-03T23:25:30.989Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: onedotprojects Products: cdn Problem Types: CWE-79 Description: 1CDN is open-source file sharing software. In 1CDN before commit f88a2730fa50fc2c2aeab09011f6f142fd90ec25, there is a basic cross-site scripting vulnerability that allows an attacker to inject /<script>//code</script> and execute JavaScript code on the client side. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/onedotprojects/cdn/security/advisories/GHSA-g5c4-48rw-hjgh - https://github.com/onedotprojects/c
s: - https://github.com/onedotprojects/cdn/security/advisories/GHSA-g5c4-48rw-hjgh - https://github.com/onedotprojects/cdn/commit/f88a2730fa50fc2c2aeab09011f6f142fd90ec25
CVE ID: CVE-2021-32617 State: PUBLISHED Published: 2021-05-17T00:00:00 Last Updated: 2024-08-03T23:25:30.946Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-400 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running
cker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `rm`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj - https://github.com/Exiv2/exiv2/pull/1657 - https://lists.fedoraproject.org/archives/list/package-a
GHSA-w8mv-g8qq-36mj - https://github.com/Exiv2/exiv2/pull/1657 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/ - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-32618 State: PUBLISHED Published: 2021-05-17T18:05:11 Last Updated: 2024-08-03T23:25:30.629Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Flask-Middleware Products: flask-security Problem Types: CWE-601 Description: The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either re
onoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered
a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-6qmf-fj6m-686c - https://github.com/Flask-Middleware/flask-security/issues/486
CVE ID: CVE-2021-32619 State: PUBLISHED Published: 2021-05-28T21:00:12 Last Updated: 2024-08-03T23:25:30.920Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: denoland Products: deno Problem Types: CWE-285 Description: Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. The vulnerability has been patched in Deno release 1.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com
been patched in Deno release 1.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/denoland/deno/security/advisories/GHSA-xpwj-7v8q-mcgj
CVE ID: CVE-2021-32620 State: PUBLISHED Published: 2021-05-28T21:05:15 Last Updated: 2024-08-03T23:25:30.545Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-285 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the
m has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65 - https://jira.xwiki.org/browse/XWIKI-17942 - https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4
CVE ID: CVE-2021-32621 State: PUBLISHED Published: 2021-05-28T21:05:11 Last Updated: 2024-08-03T23:25:30.541Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-94 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-plat
2.10.3 and 13.0RC1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h353-hc43-95vc - https://jira.xwiki.org/browse/XWIKI-17794 - https://github.com/xwiki/xwiki-platform/commit/bb7068bd911f91e5511f3cfb03276c7ac81100bc - https://jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html
CVE ID: CVE-2021-32622 State: PUBLISHED Published: 2021-05-17T19:35:11 Last Updated: 2024-08-03T23:25:30.863Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: matrix-org Products: matrix-react-sdk Problem Types: CWE-74 Description: Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other user
ab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv - https://github.com/matrix-org/matrix-react-sdk/pull/5981
CVE ID: CVE-2021-32623 State: PUBLISHED Published: 2021-06-15T23:45:10 Last Updated: 2024-08-03T23:25:30.875Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: opencast Products: opencast Problem Types: CWE-776 Description: Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixe
exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencast/opencast/security/advisories/GHSA-9gwx-9cwp-5c2m - https://github.com/opencast/opencast/commit/8ae27da5a6f658011a5741b3210e715b0dc6213e
CVE ID: CVE-2021-32624 State: PUBLISHED Published: 2021-05-24T16:55:09 Last Updated: 2024-08-03T23:25:31.007Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: keystonejs Products: keystone-5 Problem Types: CWE-200 Description: Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control related oracle attack in that the attack method guides an attacker during their attempt to reveal information they do not have access to. The compl
at the attack method guides an attacker during their attempt to reveal information they do not have access to. The complexity of completing the attack is limited by some length-dependent behaviors and the fidelity of the exposed information. Under some circumstances, field values or field value meta data can be determined, despite the field or list having `read` access control configured. If you use private fields or lists, you may be impacted. No patches exist at this time. There are no workarounds at this time Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keystonejs/keystone-5/security/advisories/GHSA-27g8-r9vw-765x
CVE ID: CVE-2021-32625 State: PUBLISHED Published: 2021-06-02T19:35:11 Last Updated: 2024-08-03T23:25:30.543Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-680 Description: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem wi
by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq - https://github.com/redis/redis/releases/tag/6.0.14 - https://github.com/redis/redis/releases/tag/6.2.4 - https://lists.fedora
://github.com/redis/redis/releases/tag/6.0.14 - https://github.com/redis/redis/releases/tag/6.2.4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/
CVE ID: CVE-2021-32626 State: PUBLISHED Published: 2021-10-04T17:30:11 Last Updated: 2024-08-03T23:25:30.986Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-122, CWE-787 Description: Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6,
exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c - https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3AT
cf93fdf591 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/ - https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/ - https://www.debian.org/security/2021/dsa-5001 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211104-00
sa-5001 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211104-0003/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2021-32627 State: PUBLISHED Published: 2021-10-04T17:35:16 Last Updated: 2024-08-03T23:25:30.868Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-190, CWE-680 Description: Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redi
ameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3 - https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v - https://lists.fedoraproject.org/arc
081d80ae3 - https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/ - https://www.debian.org/security/2021/dsa-5001 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211104-0003/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2021-32628 State: PUBLISHED Published: 2021-10-04T17:35:11 Last Updated: 2024-08-03T23:25:30.918Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-190, CWE-680 Description: Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large val
ash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr - https://github.com/redis/redis/commit/
ences: - https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr - https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/ - https://www.debian.org/security/2021/dsa-5001 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advis
.org/security/2021/dsa-5001 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211104-0003/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2021-32629 State: PUBLISHED Published: 2021-05-24T15:35:11 Last Updated: 2024-08-03T23:25:30.928Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-788 Description: Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape in a Wasm program. This bug was introduced in the new backend on 2020-09-08 and first included in a release on 2020-09-30, but the new backend
s bug was introduced in the new backend on 2020-09-08 and first included in a release on 2020-09-30, but the new backend was not the default prior to 0.73. The recently-released version 0.73 with default settings, and prior versions with an explicit build flag to select the new backend, are vulnerable. The bug in question performs a sign-extend instead of a zero-extend on a value loaded from the stack, under a specific set of circumstances. If those circumstances occur, the bug could allow access to memory addresses upto 2GiB before the start of the Wasm program heap. If the heap bound is larger than 2GiB, then it would be possible to read memory from a computable range dependent on the size