Amazon Linux AMI : vim (ALAS-2023-1716)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1716 advisory. A heap buffer overflow vulnerability was found in vim's inscomplinfercasegettext function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completin...

Amazon Linux 2 : vim (ALAS-2023-2005)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2005 advisory. A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because there is access...

CVE-2022-25731 Incorrect Calculation of Buffer Size in MODEM

Information disclosure in modem due to buffer over-read while processing packets from DNS server...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-151)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-151 advisory. A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because there is acce...

MuteAmplifier.sol: multiplier calculation is incorrect which leads to loss of rewards for almost all stakers

Lines of code Vulnerability details Impact This report deals with how the calculation of the multiplier in the MuteAmplifier contract is not only different from how it is displayed in the documentation on the website but it is also different in a very important way. The calculation on the website...

Incorrect minOut calculation in SfrxEth.withdraw()

Lines of code Vulnerability details Impact Final value of mintOut will be lower or higher according to the SFRXETH/FRXETH price ratio. This can result in higher slippage where user can loss funds. Else in other case the slippage will be low and transaction gets reverted unexpectedly Proof of...

poolPrice in Reth.sol can overflow and revert

Lines of code Vulnerability details Impact To determine the value of sqrtPriceX96 that will cause an overflow, we need to analyze the calculation in the function: sqrtPriceX96 uintsqrtPriceX96 1e18 96 2 The maximum value for a uint256 is 2^256 - 1. An overflow occurs when the result of the...

CBL Mariner 2.0 Security Update: vim (CVE-2023-1175)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-1175 advisory. - Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. CVE-2023-1175 Note that...

MGASA-2023-0110 Updated vim packages fix security vulnerability

Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. CVE-2023-1170 Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. CVE-2023-1175...

[slackware-security] vim

New vim packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/vim-9.0.1418-i586-1slack15.0.txz: Upgraded. Fixed security issues: NULL pointer dereference issue in utfcptr2len. Incorrect Calculation o...

The users will receive a wrong liquidity token amount because there is an error in the token price calculation in the LiquidityPool::processDeposits() function

Lines of code Vulnerability details Impact The processDeposits helps to process the users deposits that were queued in the queueDeposit function. The processDeposits function iterates multiple queued deposits and increases the totalFunds storage variable which is used to the accountability of the...

Slackware Linux 15.0 / current vim Multiple Vulnerabilities (SSA:2023-079-02)

The version of vim installed on the remote host is prior to 9.0.1418. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-079-02 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. CVE-2023-1170 - Incorrect Calculation of Buffer...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Vim vulnerabilities (USN-5963-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5963-1 advisory. It was discovered that Vim was not properly performing memory management operations. An attacker could possibly use...

Fedora 38 : vim (2023-43cb13aefb)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-43cb13aefb advisory. Security fixes for CVE-2023-1175, CVE-2023-1170, CVE-2023-1264. Tenable has extracted the preceding description block directly from the Fedora...

Incorrect calculation of gasToPay due to dividing before multiplying, rounding error.

Lines of code Vulnerability details Impact In Solidity, it is an error to divide before multiplying because of lots of rounding errors that can come from that. In this case: uint256 pubdataLen; unchecked pubdataLen = message.length + 31 / 32 32 + 64; uint256 gasToPay = pubdataLen...

Wrong block number calculation

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The calculation for the block info is currentBlockNumber + 1 BLOCKINFOBLOCKNUMBERPART + newTimestamp. getBlockNumberAndTimestamp, getBlockTimestamp, getBlockNumber all incorrectly calculate the current...

Division before multiply results in precision loss

Lines of code Vulnerability details Impact Precision loss occurs when division is carried out before multiplication, that can affect gas calculation in terms of publishing the data to L1. Proof of Concept Tools Used Manual Review Recommended Mitigation Steps Recommendation is made for avoiding...

The price fee for fusion characters is incorrect.

Lines of code Vulnerability details Vulnerability details Price fee for fusion characters is incorrect. According to the docs Fusing To fuse a namespace NFT, the user specifies the trays and the tiles offsets within the trays to use. Note that the whole tray is always burned, even if you only use...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vim (SUSE-SU-2023:0781-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0781-1 advisory. - CVE-2023-0512: Fixed a divide By Zero bsc1207780. - CVE-2023-1175: vim: an incorrect calculati...

SUSE SLES12 Security Update : vim (SUSE-SU-2023:0760-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0760-1 advisory. - CVE-2023-0512: Fixed a divide By Zero bsc1207780. - CVE-2023-1175: vim: an incorrect calculation of buffer size bsc1208957. -...