Moderate: go-toolset and golang security and bug fix update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fixes: golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputi...

Upgraded Q -> M from #254 [1674418824740]

Judge has assessed an item in Issue 254 as M risk. The relevant finding follows: 03: Lock.claimGovFees will revert with tokens that have approve race condition protection Some tokens only allow you to approve a new value if the current allowance is set to zero, e.g. USDT. This is not an issue rig...

ManageEngine Vulnerability CVE-2022-47966

Recently, Zoho ManageEngine released a security advisory for CVE-2022-47966, which allows for pre-authentication remote code execution in at least 24 ManageEngine products, including ADSelfService Plus and ServiceDesk Plus. This vulnerability stems from the products’ use of an outdated Apache...

OracleLib: Price can be negative

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

LastPass users should move their crypto funds, experts warn

Several experts have warned LastPass users who store cryptocurrency-related login information in their vaults to change that login information as soon as they can. Apparently, cybercriminals who have access to the stolen information are making it a priority to decrypt the data in an attempt to...

Google Chrome Vulnerability Exposes Data of 2.5 Billion Users

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A vulnerability in Google Chrome could affect over 2.5 billion users. An attacker can exploit this vulnerability for the theft of sensitive files, such as crypto wallets and cloud provider...

Design/Logic Flaw

Use of a Broken or Risky Cryptographic Algorithm in the function mbedtlsmpiexpmod in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information typically an untrusted operating system attacking a...

UBUNTU-CVE-2021-36647

Use of a Broken or Risky Cryptographic Algorithm in the function mbedtlsmpiexpmod in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information typically an untrusted operating system attacking a...

GSD-2023-1001420 crypto: ccree - Remove debugfs when platform_driver_register failed

crypto: ccree - Remove debugfs when platformdriverregister failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001416 crypto: tcrypt - Fix multibuffer skcipher speed test mem leak

crypto: tcrypt - Fix multibuffer skcipher speed test mem leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001104 crypto: tcrypt - Fix multibuffer skcipher speed test mem leak

crypto: tcrypt - Fix multibuffer skcipher speed test mem leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000971 crypto: hisilicon/hpre - fix resource leak in remove process

crypto: hisilicon/hpre - fix resource leak in remove process This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000698 crypto: ccree - Remove debugfs when platform_driver_register failed

crypto: ccree - Remove debugfs when platformdriverregister failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000693 crypto: tcrypt - Fix multibuffer skcipher speed test mem leak

crypto: tcrypt - Fix multibuffer skcipher speed test mem leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000530 crypto: hisilicon/hpre - fix resource leak in remove process

crypto: hisilicon/hpre - fix resource leak in remove process This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000524 crypto: hisilicon/qm - increase the memory of local variables

crypto: hisilicon/qm - increase the memory of local variables This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000417 virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()

virtio-crypto: fix memory leak in virtiocryptoalgskcipherclosesession This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.19 by commit...

Google Ads Malware Wipes NFT Influencer’s Crypto Wallet

By Habiba Rashid NFT influencer @NFTGOD downloaded malware through Google Ads while attempting to download OBS, an open-source video streaming software. This is a post from HackRead.com Read the original post: Google Ads Malware Wipes NFT Influencers Crypto Wallet...

Upgraded G -> 3 from #90 [1673938387276]

Judge has assessed an item in Issue 90 as 3 risk. The relevant finding follows: fenkge;gk --- The text was updated successfully, but these errors were encountered: All reactions...

PT-2023-33601 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue concerns increasing the memory of local variables in the crypto: hisilicon/qm module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...