mrubyc vulnerabilities

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.

An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().