CVE-2023-27117: 
Linux Debian vulnerability analysis and mitigation

WebAssembly v1.0.29 was discovered to contain a heap overflow vulnerability via the component wabt::Node::operator. The vulnerability was identified and disclosed in September 2022, affecting the WebAssembly Binary Toolkit (WABT) (GitHub Issue).

The vulnerability exists in the wabt::Node::operator component of WebAssembly v1.0.29, specifically in the decompiler-ast.h file. When triggered, it causes a heap-buffer-overflow on address 0x610000000010, resulting in a READ operation of size 4. The issue was discovered during testing with Address Sanitizer (ASAN) and has been assigned a CVSS score of 7.8, indicating high severity (CISA Bulletin).

The heap overflow vulnerability could lead to memory corruption and potential crashes in the WebAssembly Binary Toolkit. This could affect systems and applications that rely on WABT for WebAssembly binary manipulation and translation (Debian Tracker).

The vulnerability affects WABT version 1.0.29 and has been identified in multiple Linux distributions including Debian bullseye (1.0.20-1), bookworm (1.0.32-1), and sid/trixie versions. Users are advised to update to patched versions when available (Debian Tracker).