Root takeover via signature spoofing

Description When an app requests "CMDBECOMEMANAGER" via prctl, couple of checks done before promoting uid as root manager. Main check relies on requester's signature. Signature control is done in checkv2signature function in kernel\apksign.c, this function accepts both V2 and V3 signatures...

GO-2023-2096 Signature malleability in github.com/consensys/gnark-crypto

Signature malleability in github.com/consensys/gnark-crypto...

The vulnerability of the Security component in operating systems such as tvOS, iOS, iPadOS, watchOS, and macOS allows attackers to bypass signature checks.

The vulnerability of the Security component in operating systems such as tvOS, iOS, iPadOS, watchOS, and macOS is related to errors in the certificate validation process. Exploiting this vulnerability can allow attackers to bypass the signature verification...

Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fr8m-434r-g3xp. This link is maintained to preserve external references. Original Description Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and...

GHSA-9XFQ-8J3R-XP5G Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fr8m-434r-g3xp. This link is maintained to preserve external references. Original Description Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and...

CVE-2023-44273

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval...

CVE-2023-44273

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval...

Design/Logic Flaw

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval...

gnark-crypto Code Issue Vulnerability

gnark-crypto is an open source library from Consensys. Provides elliptic curve and pairing-based cryptography on BN, BLS12, BLS24 and BW6 curves. A code issue vulnerability exists in Consensys gnark-crypto 0.11.2 and earlier versions, which stems from the presence of a deserialization vulnerabili...

CVE-2023-44273

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval...

CVE-2023-44273

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval...

Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fr8m-434r-g3xp. This link is maintained to preserve external references. Original Description Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and...

CVE-2023-44273

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval...

CVE-2023-44273

CVE-2023-44273 (gnark-crypto) affects github.com/consensys/gnark-crypto up to v0.11.2. During ECDSA/EdDSA signature deserialization, the library does not enforce that values lie in the range [1, n−1], enabling signature malleability and potential DoS. The issue has been fixed in v0.12.0 (PR #449)...

CVE-2023-44128

he vulnerability is to delete arbitrary files in LGInstallService "com.lge.lginstallservies" app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage" methods are finally calling the "installPackageVerify" method...

CVE-2023-44128

he vulnerability is to delete arbitrary files in LGInstallService "com.lge.lginstallservies" app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage" methods are finally calling the "installPackageVerify" method...

Design/Logic Flaw

he vulnerability is to delete arbitrary files in LGInstallService "com.lge.lginstallservies" app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage" methods are finally calling the "installPackageVerify" method...

New ZenRAT Malware Targeting Windows Users via Fake Password Manager Software

A new malware strain called ZenRAT has emerged in the wild that's distributed via bogus installation packages of the Bitwarden password manager. "The malware is specifically targeting Windows users and will redirect people using other hosts to a benign web page," enterprise security firm Proofpoi...

The vulnerability of the Security component in iOS, watchOS, iPadOS, and macOS operating systems allows attackers to bypass digital signatures checks.

The vulnerability of the Security component in iOS, watchOS, iPadOS, and macOS is related to errors in the certificate validation process. Exploiting this vulnerability can allow attackers to bypass digital signature checks...

PT-2023-29183 · Consensys · Gnark-Crypto

Name of the Vulnerable Software and Affected Versions: Consensys gnark-crypto versions 0.11.2 and earlier Description: The issue occurs due to the deserialisation of EdDSA and ECDSA signatures not ensuring that the data is in a certain interval, allowing Signature Malleability. Recommendations: F...