GSD-2022-1007157 nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure

nilfs2: replace WARNONs by nilfserror for checkpoint acquisition failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.74 by commit...

GSD-2022-1006929 nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure

nilfs2: replace WARNONs by nilfserror for checkpoint acquisition failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.2 by commit...

PT-2022-35412 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.74 Description: The issue concerns the nilfs2 file system in the Linux Kernel, where checkpoint acquisition failure is not properly handled, potentially leading to security vulnerabilities. The actual impa...

PT-2022-35868 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.296 Description: The issue is related to the nilfs2 file system in the Linux Kernel, where checkpoint acquisition failure is not properly handled, potentially leading to security vulnerabilities. The actua...

PT-2022-35586 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.148 Description: The issue concerns the nilfs2 file system in the Linux Kernel, where checkpoint acquisition failure is not properly handled, potentially leading to security vulnerabilities. The actual...

PT-2022-35795 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.262 Description: The issue concerns the nilfs2 file system in the Linux Kernel, where checkpoint acquisition failure is not properly handled, potentially leading to security vulnerabilities. The actual...

ERROR IN UPDATING **_checkpoint** IN THE **increaseUnlockTime** FUNCTION

Lines of code Vulnerability details Impact The potentiel impact of this error are : Give wrong voting power to a user at a given block. Give wrong total voting power at a given block. Give wrong total voting power. Proof of Concept The error occured in this line : In the increaseUnlockTime functi...

Wrong values are passed to _checkpoint mess up accounting

Lines of code Vulnerability details Impact The increaseUnlockTime function sends a wrong unlock time to the checkpoint function in the oldLocked variable - the locked variable which is the new LockedBalance is copied into the oldLocked variable which is supposed to be the previous LockedBalance,...

The _checkpoint function won't be called for a user which is both a delegator and a delegatee in the increaseUnlockTime function

Lines of code Vulnerability details Impact The virtual balance of a user is calculated using 2 values - the amount that is delegated to that user, and his lock period. When calling the increaseUnlockTime function, we want to checkpoint the user's data as long as he doesn't have any funds. This is...

increaseUnlockTime missing _checkpoint for delegated values

Lines of code Vulnerability details PNM-001 increaseUnlockTime missing checkpoint for delegated values. Links Description In the VotingEscrow contract, users can increase their voting power by: Adding more funds to their delegated valule Increasing the time of their lock Being delegated by anothe...

The toLocked.end >= fromLocked.end in delegate function is inconsistent with design.

Lines of code Vulnerability details Impact The condition of toLocked.end = fromLocked.end in function delegate is inconsistent with design in veFDT Checkpoint Math Proof of Concept In VotingEscrow.sol. L589 requiretoLocked.end = fromLocked.end, "Only delegate to longer lock"; But In veFDT...

virt:kvm_utils security update

libvirt 5.7.0-34.el8 - qemu: blockcopy: Allow late opening of the backing chain of a shallow copy Peter Krempa Orabug: 33091019 - qemu: capabilities: Introduce QEMUCAPSBLOCKDEVSNAPSHOTALLOWWRITEONLY Peter Krempa Orabug: 33091019 - qemuDomainBlockCopyCommon: Record updated flags to block job Peter...

delegate modifies old checkpoint

Lines of code Vulnerability details Impact VoteEscrow tokens are used as voting tokens for a GovernorAlpha governance. It shouldn't be possible to modify an old meaning for blocks older than block.number checkpoint, otherwise it's possible to buy tokens just to vote for a proposal and then sell...

libvirt libvirt-python security update

libvirt 5.7.0-34.el7 - qemu: blockcopy: Allow late opening of the backing chain of a shallow copy Peter Krempa Orabug: 33091019 - qemu: capabilities: Introduce QEMUCAPSBLOCKDEVSNAPSHOTALLOWWRITEONLY Peter Krempa Orabug: 33091019 - qemuDomainBlockCopyCommon: Record updated flags to block job Peter...

MAL-2022-1329 Malicious code in azure-eventhubs-checkpointstore-blob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 446f07ebe7277743c5b75edd4e41ddee867b36339feabc5d6040ae83fb8c8ea8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

In gauge, checkpoint.voted is incorrectly copied from previous checkpoint (always false in new checkpoint)

Lines of code Vulnerability details Impact When a user interacts with a gauge and a new balance checkpoint is created in storage of this gauge, then checkpoint.voted for this new checkpoint is always false. Unless users are aware of this bug and call voter.poke after each interaction with the gau...

User rewards stop accruing after any _writeCheckpoint calling action

Lines of code Vulnerability details Any user balance affecting action, i.e. deposit, withdraw/withdrawToken or getReward, calls writeCheckpoint to update the balance records used for the earned reward estimation. The issue is that writeCheckpoint always sets false to voted flag for the each new...

jigawatts bug fix and enhancement update

An update is available for jigawatts. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Jigawatts is a new package introduced in Rocky Linux 8.5 & 9.0 to facilitat...

cockpit security, bug fix, and enhancement update

264.1-1.0.1 - Remove duplicate reference to server in cockpit Orabug: 33862832 - Update documentation links Orabug: 32795691 - Make documentation links point to Oracle Linux information Orabug: 30271413 Orabug: 32013095 - Fix rendering of hwinfo page on systems with some empty memory slots Orabug...

Vulnerability fixed in Check Point Endpoint Security Client

Check Point has fixed a vulnerability in Check Point Endpoint Security Client for Windows. A local malicious agent could exploit the vulnerability to obtain elevated privileges and then execute arbitrary code under those privileges. To do so, the malicious party must place rogue files in a...