1119 matches found
CVE-2024-8385
CVE-2024-8385 is a WASM type confusion vulnerability caused by how StructFields and ArrayTypes are handled. Affects Firefox (versions before 130) and Firefox ESR (before 128.2) and Thunderbird (before 128.2). Exploitation could lead to high-impact outcomes per the CVE. Remediation in the public d...
CVE-2024-8385: Access of Resource Using Incompatible Type
A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...
KLA73124 Multiple vulnerabilities in Mozilla Firefox ESR
Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack, cause denial of service, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1...
PT-2024-5925
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 130 Firefox ESR versions prior to 128.2 Thunderbird versions prior to 128.2 Description A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion...
Uncontrolled Resource Consumption
github.com/CosmWasm/wasmvm is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper handling of specifically crafted Wasm files, leading to high memory usage, potential slowdowns, crashes, and lock poisoning in the VM and potentially leads to DoS...
GHSA-75QH-GG76-P2W4 CWA-2023-004: Excessive number of function parameters in compiled Wasm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see...
CWA-2023-004: Excessive number of function parameters in compiled Wasm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see...
RUSTSEC-2024-0366 CWA-2023-004: Excessive number of function parameters in compiled Wasm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see...
CWA-2023-004: Excessive number of function parameters in compiled Wasm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see...
Exploit for Type Confusion in Google Chrome
CVE-2024-2887 This is a short writeup for the CVE-2024-2887,...
Exploit for Type Confusion in Google Chrome
CVE-2024-1939 This is a short writeup for the CVE-2024-1939,...
GHSA-RG2Q-2JH9-447Q Gas mispricing in cosmwasm-vm
Component: wasmvm Criticality: Medium ACMv1: I:Moderate; L:Likely Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2 Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of 10x. This means a malicious contract cou...
Gas mispricing in cosmwasm-vm
Component: wasmvm Criticality: Medium ACMv1: I:Moderate; L:Likely Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2 Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of 10x. This means a malicious contract cou...
cosmwasm-check (>=1.1.0-rc.1, <=1.3.4), cw-check-contract (1.0.1) +4 more potentially affected by unknown CVE via cosmwasm-vm (>=1.2.8, <=1.3.4)
cosmwasm-vm CARGO version =1.2.8, =1.1.0-rc.1, =0.5.3-2, =0.6.0-beta1, =0.17.1 Source cves: unknown CVE Source advisory: OSV:GHSA-RG2Q-2JH9-447Q...
CWA-2024-004: Gas mispricing in cosmwasm-vm
Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of 10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. For more...
cosmwasm-check (>=1.1.0-rc.1, <=1.3.4), cw-check-contract (1.0.1) +4 more potentially affected by unknown CVE via cosmwasm-vm (>=1.2.8, <=1.3.4)
cosmwasm-vm CARGO version =1.2.8, =1.1.0-rc.1, =0.5.3-2, =0.6.0-beta1, =0.17.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0361...
RUSTSEC-2024-0361 CWA-2024-004: Gas mispricing in cosmwasm-vm
Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of 10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. For more...
SUSE-SU-2024:2574-1 Security update for nodejs20
This update for nodejs20 fixes the following issues: Update to 20.15.1: - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass bsc1227560 - CVE-2024-22020: Fixed a bypass of network import restriction via data URL bsc1227554 - CVE-2024-22018: Fixed fs.lstat bypasses permission model bsc1227562 -...
