Dfinity - vulnerabilities (CVEs)

5 CVEs in 6 products, 0 in the last 30 days, newest from 2024-12-09.

Products

• Agent-js - 1 CVEs
• Candid - 1 CVEs
• Canister Developer Kit For The Internet Computer - 1 CVEs
• Icp-js-core - 1 CVEs
• Motoko - 1 CVEs
• Stable Structures - 1 CVEs

Newest CVEs of Dfinity

• CVE-2024-11991 - CVSS 6.5 (medium), 2024-12-09: Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This…
• CVE-2024-7884 - CVSS 7.5 (high), 2024-09-05: When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result.…
• CVE-2024-4435 - CVSS 7.5 (high), 2024-05-21: When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a…
• CVE-2024-1631 - CVSS 9.1 (critical), 2024-02-21: Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value,…
• CVE-2023-6245 - CVSS 7.5 (high), 2023-12-08: The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { * ;…