Should check return data from Chainlink aggregators

Handle shw Vulnerability details Impact The getEtherPrice function in the contract FSDNetwork fetches the ETH price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on roundID nor timeStamp, resulting in stale prices. Proof of Concept Referenced code:...

systemd security, bug fix, and enhancement update

239-45.0.1 - backport upstream pstore tmpfiles patch Orabug: 31420486 - udev rules: fix memory hot add and remove Orabug: 31310273 - fix to enable systemd-pstore.service Orabug: 30951066 - journal: change support URL shown in the catalog entries Orabug: 30853009 - fix to generate...

Unchecking the ownership of mph in function distributeFundingRewards could cause several critical functions to revert

Handle shw Vulnerability details Impact In contract MPHMinter, the function distributeFundingRewards does not check whether the contract itself is the owner of mph. If the contract is not the owner of mph, mph.ownerMint could revert, causing functions such as withdraw, rolloverDeposit,...

Anyone can call onERC721Received() function and spam the array "nfts"

Handle Sherlock Vulnerability details Impact An attacker can deal direct economic damage to the owner/delegate spending some gas to spam the array of "nfts" with different values. It will be more costly to remove these nfts one-by-one, transaction-by-transaction. Also, it makes other functions...

kernel security and bug fix update

4.18.0-240.8.13.OL8 - Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64...

Moodle 访问控制错误漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from an Access Control Error vulnerability that stems from a failure to adequately check a user's ability to enroll when...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

Unbreakable Enterprise kernel security update

5.4.17-2011.7.4 - iommu/amd: Restore IRTE.RemapEn bit for amdiommuactivateguestmode Suravee Suthikulpanit Orabug: 31931369 - iommu/amd: Fix potential @entry null deref Joao Martins Orabug: 31931369 - iommu/amd: Restore IRTE.RemapEn bit after programming IRTE Suravee Suthikulpanit Orabug: 31931369...

USN-4516-1: GnuPG vulnerability

It was discovered that GnuPG signatures could be forged when the SHA-1 algorithm is being used. This update removes validating signatures based on SHA-1 that were generated after 2019-01-19. In environments where this is still required, a new option --allow-weak-key-signatures can be used to reve...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2020:1382-1 Rating: important References: 1065729 1071995 1085030 1133021 1154492 1156395 1159058 1160634 1169790 1171634 1171688 1172108 1172418 1172871 1173485 1173798 1174003 1174026 1174387 1174699...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0028)

The remote OracleVM system is missing necessary patches to address critical security updates : - ipv4: ipv4defaultadvmss should use route mtu Eric Dumazet Orabug: 31563095 - net: ipv4: Refine the ipv4defaultadvmss Gao Feng Orabug: 31563095 - Revert 'bnxten: Remove busy poll logic in the driver.'...

USN-4385-2 intel-microcode regression

USN-4385-1 provided updated Intel Processor Microcode. Unfortunately, that update prevented certain processors in the Intel Skylake family 064EH from booting successfully. Additonally, on Ubuntu 20.04 LTS, late loading of microcode was enabled, which could lead to system instability. This update...

USN-4360-3 json-c regression

USN-4360-1 fixed a vulnerability in json-c. The security fix introduced a memory leak in some scenarios. This update reverts the security fix pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that json-c incorrectly handled certain JSO...

kernel security update

2.6.32-754.29.1.OL6 - Update genkey bug 25599697 2.6.32-754.29.1 - wireless rtlwifi: Fix potential overflow on P2P code Jarod Wilson 1775226 CVE-2019-17666 - x86 mm: revert x8664 and arm64 ELFETDYNBASE base changes Denys Vlasenko 1485759 - powerpc powerpc: move ELFETDYNBASE to 4GB / 4MB Denys...

Unbreakable Enterprise kernel security update

4.1.12-124.36.3 - Fix KABI error by keeping the struct field being removed by the below patch Ritika Srivastava Orabug: 30902926 - Revert 'PCI: Check pref compatible bit for mem64 resource of PCIe device' Ritika Srivastava Orabug: 30902926 4.1.12-124.36.2 - rds: Use bitmap to designate dropped...

UBUNTU-CVE-2019-19076

A memory leak in the nfpabmu32knodereplace function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service memory consumption, aka CID-78beef629fd9. NOTE: This has been argued as not a valid vulnerability. The upstream commit...

ALBA-2019:2724 container-tools:1.0 bug fix update

Bug Fixes: stream 1.0 need to revert fuse-overlayfs commit to sync with rhel8 stream BZ1720707...

unixODBC security update

2.3.1-14.0.1 - backport unchecked malloc memory references fix Orabug: 29684195 2.3.1-14 - fixed insecure buffer copy 1571530 - fixed possible buffer overflow 1571528 2.3.1-13 - revert: ltdl bundling 2.3.1-12 - fix the libtool-ltdl compatibility Resolves: rhbz1267438...

qemu-kvm security, bug fix, and enhancement update

1.5.3-167.el7 - Reverting kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch bz1618503 - Resolves: bz1618503 qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads rhel-7 1.5.3-166.el7 - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch bz1618503 - Resolves: bz1618503 qemu-kv...