Malicious code in metronome-synth-info-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e99092c601ede7db26a42e21544d65cff430ba4d36d1a76232973801b8d3fec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7988 Malicious code in metronome-synth-info-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e99092c601ede7db26a42e21544d65cff430ba4d36d1a76232973801b8d3fec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2023-2829

A named instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache RFC 8198 option synth-from-dnssec enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through...

AZL-27305 CVE-2023-2829 affecting package bind for versions less than 9.16.44-1

A named instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache RFC 8198 option synth-from-dnssec enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through...

CVE-2023-2829

A named instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache RFC 8198 option synth-from-dnssec enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through...

CVE-2023-2829: Undefined Security Weakness

A named instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache RFC 8198 option synth-from-dnssec enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through...

ROS-20230414-02

DNS server BIND vulnerability is related to reachable assertion in DNS query processing. Exploitation The vulnerability allows an attacker acting remotely to send repeated patterns of specific requests to servers with DNSSEC-Validated Cache synth-from-rom enabled. queries to servers with the...

SUSE CVE-2008-3272

The sndseqosssynthmakeinfo function in sound/core/seq/oss/seqosssynth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by maxsynthdev before returning certain data to the caller, which allows local users to obtain...

SUSE CVE-2019-25036

Unbound before 1.9.5 allows an assertion failure and denial of service in synthcname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited...

PT-2022-36293 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.6 through v5.10.155 Description: A memory leak issue was discovered in the Linux Kernel, specifically in the test gen synth cmd and test empty synth event functions. The actual impact and attack plausibility of this...

PT-2022-35976 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.6 through v6.0.9 Description: A memory leak issue was discovered in the tracing component, specifically in the test gen synth cmd and test empty synth event functions. This issue was introduced in version v5.6 and is...

PT-2022-38091

Уязвимость функций test gen synth cmd и test empty synth event модуля kernel/trace/synth event gen test.c поддержки трассировки ядра операционной системы Linux связана с неправильным освобождением памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Vulnerabilities fixed in BIND

The Internet Systems Consortium ISC has fixed vulnerabilities in BIND. An unauthenticated remote malicious person can exploit the exploit the vulnerabilities to perform a cache-poisoning attack or cause a denial-of-service. One of the fixed vulnerabilities has been given the attribute CVE-2022-06...

unbound: assertion failure and denial of service in synth_cname

A flaw was found in unbound. A reachable assertion in the synthcname function can be triggered by sending invalid packets to the server. If asserts are disabled during compilation, this issue might lead to an out-of-bounds write in dnamepktcopy function. The highest threat from this vulnerability...

Using single total native reserve variable for synth and non-synth reserves of VaderPoolV2 can lead to losses for synth holders

Handle hyh Vulnerability details Impact Users that mint synths do provide native assets, increasing native reserve pool, but do not get any liquidity shares issued. In the same time, an exit of non-synth liquidity provider yields releasing a proportion of all current reserves to him. Whenever an...

mintSynth() can transfer funds from an arbitrary address

Handle Critical Vulnerability details Impact Attackers can steal funds from users' balances for those who approved the VaderPoolV2 contract. Proof of Concept nativeAsset.safeTransferFromfrom, addressthis, nativeDeposit; VaderPoolV2.mintSynth allows anyone to transfer funds from an arbitrary addre...

Insufficient access control on VaderPoolV2.mintSynth allows theft of user funds

Handle TomFrenchBlockchain Vulnerability details Impact Loss of all USDV approved onto VaderPoolV2. Proof of Concept VaderPoolV2 allows minting of synth tokens with the mintSynth function This allows anyone to take USDV from the from address and mint synths to be sent to the to address. There is ...

Minting and burning synths exposes users to unlimited slippage

Handle TomFrenchBlockchain Vulnerability details Impact LPs remaining in VaderPool end up paying all transfer fees for LPs which leave the pool. Proof of Concept See VaderPoolV2.mintSynth: Here a user sends nativeDeposit to the pool and the equivalent amount of foreignAsset is minted as a synth t...

Mixing different types of LP shares can lead to losses for Synth holders

Handle hyh Vulnerability details Impact Users that mint Synths do not get pool shares, so exiting of normal LP can lead to their losses as no funds can be left for retrieval. Proof of Concept 3 types of mint/burn: NFT, Fungible and Synths. Synths are most vilnerable as they do not have share: LP...

Synth: cannot change approval once set to max value

Handle cmichel Vulnerability details The Synth.approve function performs a no-op if the allowance is currently set to typeuint256.max. This leads to the issue that approvals cannot be changed anymore once they are set to the max value. Impact Imagine someone approving an operator with the max val...