PT-2023-35798 · Git +1 · Wabt

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash has been reported with an unknown write issue. The crash involves the std:: 1::allocator traits and std:: 1::vector functions, specifically with...

(Pseudo) Random Number Generator can be gamed, allowing a user to target desirable NFT traits

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The iteratePRNG function in the Utils.sol library is used in Tray.sol:drawing, which is used to determine the tile data that a user gets when they purchase an NFT in Tray.sol:buy. An attacker can exploi...

The users can't add traits for their CidNFT's

Lines of code Vulnerability details Proof of Concept The CidNFT contract implements the add function for the users to add traits/subprotocol Id's to their CidNFT's. During calling add function, it validates whether the user is the owner of the provided CiDNFT and the user is approved by the owner...

PT-2022-22662

Name of the Vulnerable Software and Affected Versions Node.js version 18 Description A weak randomness issue exists in the WebCrypto keygen due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/crypto keygen.cc. There are two main problems: 1. The return value of...

OSV-2022-514 Heap-use-after-free in AK::HashTable<AK::StringView, AK::Traits<AK::StringView>, false>::try_lookup_for

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48405 Crash type: Heap-use-after-free READ 2 Crash state: AK::HashTable, false::trylookupfor JS::Parser::isprivateidentifiervalid JS::Parser::parseprimaryexpression...

`array!` macro is unsound in presence of traits that implement methods it calls internally

Affected versions of this crate called some methods using auto-ref. The affected code looked like this. rust let mut arr = $crate::core::mem::MaybeUninit::uninit; let mut vec = $crate::ArrayVec::::newarr.asmutptr as mut T; In this case, the problem is that asmutptr is a method of &mut MaybeUninit...

CVE-2021-42196

An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function traitsparse located in abc.c. It allows an attacker to cause Denial of Service...

swftools 代码问题漏洞

Swftools is a set of utilities for working with Adobe Flash files SWF files. swftools 2020-12-22 and earlier versions are vulnerable to a null pointer dereference, which stems from the presence of a NULL pointer dereference in the function traitsparse located in abc.c. An attacker could exploit...

PT-2022-11558

Name of the Vulnerable Software and Affected Versions swftools versions prior to 20201223 Description An issue exists in the function traits parse located in abc.c, allowing an attacker to cause Denial of Service due to a NULL pointer dereference. Recommendations For versions prior to 20201223,...

Threat Roundup for January 21 to January 28

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 21 and Jan. 28. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

CVE-2021-45704: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket unconditionally implements the Send and Sync traits...

CVE-2021-39585

An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function traitsdump located in abc.c. It allows an attacker to cause Denial of Service...

PT-2021-22657

Name of the Vulnerable Software and Affected Versions: swftools versions prior to 20200710 Description: An issue exists in the function traits dump located in abc.c, allowing an attacker to cause Denial of Service due to a NULL pointer dereference. Recommendations: For versions prior to 20200710,...

GHSA-Q9H2-4XHF-23XX Data races in im

An issue was discovered in the im crate prior to 15.1.0 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur...

Data races in magnetic

Affected versions of this crate unconditionally implemented Sync and Send traits for MPMCConsumer and MPMCProducer types. This allows users to send types that do not implement Send trait across thread boundaries, which can cause a data race. The flaw was corrected in the 2.0.1 release by adding T...

PT-2021-18966 · Apple · Ipados +6

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.1 iPadOS versions prior to 15.1 macOS Monterey versions prior to 12.0.1 tvOS versions prior to 15.1 watchOS versions prior to 8.1 macOS Big Sur versions prior to 11.6.1 Security Update versions prior to 2021-007...

CVE-2020-36438

An issue was discovered in the tinyfuture crate before 0.4.0 for Rust. Future does not have bounds on its Send and Sync traits...

CVE-2020-36436

An issue was discovered in the unicycle crate before 0.7.1 for Rust. PinSlab and Unordered do not have bounds on their Send and Sync traits...

CVE-2020-36436: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in the unicycle crate before 0.7.1 for Rust. PinSlab and Unordered do not have bounds on their Send and Sync traits...

SyncRef's clone() and debug() allow data races

Affected versions of this crate unconditionally implement Sync for SyncRef. This definition allows data races if &T is accessible through &SyncRef. SyncRef derives Clone and Debug, and the default implementations of those traits access &T by invoking T::clone & T::fmt. It is possible to create da...