CVE-2023-28431 Frontier's modexp precompile is slow for even modulus

Frontier is an Ethereum compatibility layer for Substrate. Frontier's modexp precompile uses num-bigint crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery...

CVE-2023-28431 Frontier's modexp precompile is slow for even modulus

Frontier is an Ethereum compatibility layer for Substrate. Frontier's modexp precompile uses num-bigint crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery...

GHSA-FCMM-54JP-7VF6 Frontier's modexp precompile is slow for even modulus

Impact Frontier's modexp precompile uses num-bigint crate under the hood. In the implementation, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost...

Frontier's modexp precompile is slow for even modulus

Impact Frontier's modexp precompile uses num-bigint crate under the hood. In the implementation, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost...

0xppl-solana-portfolio (1.0.0), 0xuath-sdk-react (>=0.0.2, <=0.0.23) +6419 more potentially affected by CVE-2025-3194 via bigint-buffer (1.1.5)

bigint-buffer NPM version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on bigint-buffer and may be impacted: - 0xppl-solana-portfolio 1.0.0 - 0xuath-sdk-react =0.0.2, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =0.0.77, =0.2.0, =0.1.1...

Buffer Overflow

Overview bigint-buffer is a Node utility that converts TC39 Proposed BigInts to and from buffers Affected versions of this package are vulnerable to Buffer Overflow in the toBigIntLE function. Attackers can exploit this to crash the application. PoC js let be = require'bigint-buffer';...

SUSE CVE-2021-46669

MariaDB through 10.5.9 allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used...

Denial Of Service (DoS)

mariadb is vulnerable to denial of service. An attacker can crash the application through the use-after-free in convertconsttoint when the BIGINT data type is used...

mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used

A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used, resulting in a denial of service...

Floating point exception

Description Floating point exception in udiv commit : b83285697888abbcb2286462da070d49f413ab24 Proof of Concept ruby 1 63.pow1, 0 ASAN Output ================================================================= ==747==ERROR: AddressSanitizer: FPE on unknown address 0x5626e07f6dba pc 0x5626e07f6dba b...

mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used

A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used, resulting in a denial of service...

mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used

A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used, resulting in a denial of service...

mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used

A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used, resulting in a denial of service...

MAL-2022-1582 Malicious code in bip174-bigint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9f9ab984dfda779ce0154a7af93fa1c90769b363741cca59325d432f91869d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitcoinjs-lib-bigint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee5abe0014de83de3d111ab01e42e93f93afb0456186973c93615ac2bdcbcd00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bip174-bigint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9f9ab984dfda779ce0154a7af93fa1c90769b363741cca59325d432f91869d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1586 Malicious code in bitcoinjs-lib-bigint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee5abe0014de83de3d111ab01e42e93f93afb0456186973c93615ac2bdcbcd00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AttesterSlashing number overflow

Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...

GHSA-CVJ7-5F3C-9VG9 AttesterSlashing number overflow

Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...

CVE-2022-29219

Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Because the developers represent uint64 values as native javascript...