PT-2023-28356 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.10 Description: The abi decode function in Vyper does not validate input when it is nested in an expression, allowing for bounds checking to be bypassed and resulting in incorrect results. This can be triggered by...

SUSE-SU-2023:3695-1 Security update for binutils

This update for binutils fixes the following issues: Update to version 2.41 jscPED-5778: The MIPS port now supports the Sony Interactive Entertainment Allegrex processor, used with the PlayStation Portable, which implements the MIPS II ISA along with a single-precision FPU and a few...

Malicious code in web3tool-eth-abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e13be402ee9d4db3c195949098b1f824dd7c443db3326421128b4d211aa41a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1062 Malicious code in web3tool-eth-abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e13be402ee9d4db3c195949098b1f824dd7c443db3326421128b4d211aa41a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder

Impact A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift...

DEBIAN-CVE-2023-31669

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote "...

UBUNTU-CVE-2023-31669

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote "...

CVE-2023-31669

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote "...

Interpretation Conflict

@openzeppelin/contracts is vulnerable to Interpretation Conflict. The vulnerability exists because the TransparentUpgradeableProxy clashing selector calls may not be delegated if the clashing function has a different signature with incompatible ABI encoding, which could lead to proxy revert while...

CVE-2023-30541

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

CVE-2023-30541

OpenZeppelin Contracts vulnerability CVE-2023-30541: The TransparentUpgradeableProxy can fail to delegate a function if its selector clashes with the proxy’s own selectors, causing a revert during calldata decoding when signatures are incompatible. The issue has been fixed in version 4.8.3. Impac...

CVE-2023-30541 TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

CVE-2023-30541 TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

GHSA-MX2Q-35M2-X2RH OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated

Impact A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from...

OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated

Impact A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from...

Fedora: Security Advisory for netconsd (FEDORA-2023-80b2470d3c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: netconsd-0.2-1.fc36

This is a daemon for receiving and processing logs from the Linux Kernel, as emitted over a network by the kernel's netconsole module. It supports both the old "legacy" text-only format, and the new extended format added in v4.4. The core of the daemon does nothing but process messages and drop...

[SECURITY] Fedora 38 Update: netconsd-0.2-1.fc38

This is a daemon for receiving and processing logs from the Linux Kernel, as emitted over a network by the kernel's netconsole module. It supports both the old "legacy" text-only format, and the new extended format added in v4.4. The core of the daemon does nothing but process messages and drop...

Contracts are susceptible for Head Overflow Bug in Calldata

Lines of code Vulnerability details Impact ABI-encoding a tuple with a statically-sized calldata array in the last component would corrupt 32 leading bytes of its first dynamically encoded component. Proof of Concept The functions are taking input arguments as calldata. Following contracts are...

Debian: Security Advisory (DSA-2015-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...