PT-2023-30140 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7 through 3.7.18 GitHub Enterprise Server versions 3.8 through 3.8.11 GitHub Enterprise Server versions 3.9 through 3.9.6 GitHub Enterprise Server versions 3.10 through 3.10.3 GitHub Enterprise Server...

The vulnerability of the cloud-based video conversion, annotation, and format conversion application for Adobe Prelude involves accessing an uninitialized pointer, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of the cloud-based video conversion, annotation, and format conversion application for Adobe Prelude relates to access to an uninitialized pointer during processing of MP4 files. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected informati...

_determineTransferAmount does't support low decimal tokens.

Lines of code Vulnerability details Impact determineTransferAmount does't support low decimal tokens. Transfer amount will be force set to incorrect amount. Proof of Concept In process of erc20Wrap,in order to support different decimal tokens, the contract use determineTransferAmount to get...

Issue with Decimal Conversion in Shell Protocol

Lines of code Vulnerability details Impact The identified issue within the convertDecimals function in the Shell Protocol could lead to a loss of value due to decimal truncation during token conversions. This situation is particularly critical in the context of Shell Protocol's operations, which...

Handling Potential Slippage Due to Truncation

Lines of code Vulnerability details Impact The potential slippage issue arises from the precision loss during decimal conversion in the primitiveOutputAmount function. When interacting with the Curve Tricrypto Pool, especially involving tokens with different decimal precisions, truncation can lea...

openssl: Possible DoS translating ASN.1 object identifiers

A flaw was found in OpenSSL resulting in a possible denial of service while translating ASN.1 object identifiers. Applications that use OBJobj2txt directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience long delays when...

Google Android elevation of privilege vulnerability (CNVD-2024-07129)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to a lack of bounds checking in the code conversion QToFloat in the btifavrcpaudiotrack.cc script, which can be exploited by an attacker to gain elevat...

PT-2023-35625 · Hdf5 · Hdf5

Name of the Vulnerable Software and Affected Versions: HDF5 affected versions not specified Description: A heap buffer overflow read issue has been identified, which can cause a crash. The crash occurs in the H5T bit copy, H5T bit get d, and H5T conv f f functions. Recommendations: At the moment,...

MGASA-2023-0329 Updated docker packages fix security vulnerabilities and bugs

This update fixes several security issues and also solves some other issues - manage change of launch option earlier in post process - Automatically convert -g option to --data-root in installed /etc/sysconfig/docker-storage - Fix CVE-2023-26054 and CVE-2023-28840-2...

The vulnerability of the Squid proxy server is related to improper conversion between numerical types and uncontrolled resource consumption, allowing attackers to cause service failures.

The vulnerability of the Squid proxy server is related to the issue of sending FTP URL addresses in HTTP requests, or creating FTP URL addresses from input data of the FTP Native. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Arbitrary Price Manipulation

vendure is vulnerable to Arbitrary Price Manipulation. The vulnerability is due to the ability to specify an arbitrary currencyCode as a query parameter to an API call, allowing users to select any currencyCode and thus payments made through Mollie and Stripe in that particular currencyCode are...

OESA-2023-1828 shadow security update

This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts Security Fixes: shadow: TOCTOU time-of-check time-of-use race condition when copying and removing directory treesCVE-2013-4235...

OESA-2023-1820 GraphicsMagick security update

GraphicsMagick is the swiss army knife of image processing. Comprised of 267K physical lines according to David A. Wheeler's SLOCCount of source code in the base package or 1,225K including 3rd party libraries it provides a robust and efficient collection of tools and libraries which support...

kernel: selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()

In the Linux kernel, the following vulnerability has been resolved: selinux: enable use of both GFPKERNEL and GFPATOMIC in convertcontext The following warning was triggered on a hardware environment: SELinux: Converting 162 SID table entries... BUG: sleeping function called from invalid context ...

ruby: Buffer overrun in String-to-Float conversion

A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read...

procps-ng security and bug fix update

3.3.17-13.0.1 - ps: remove uptime integer conversion Orabug: 35909347 - ps: improved three elapsed 'jiffies/tics' calculations Orabug: 35909347 3.3.17-13 - ps: mitigation of possible buffer overflow - Resolves: rhbz2228504 3.3.17-12 - sysctl: '-N' option shows values instead of names if '-p' -...

mariadb: use-after-poison when complex conversion is involved in blob

A flaw was found in the MariaDB Server, where it contains a use-after-free in the component, Itemfuncin::cleanup. This issue is exploited via specially crafted SQL statements, affecting availability...

kernel: nvme-pci: fix mempool alloc size

A flaw was addressed in the Linux kernel’s nvme-pci driver related to how the driver calculated the worst-case number of PRP Physical Region Page lists required for a given I/O request. The implementation previously rounded the allocation to one list instead of correctly converting the maximum si...

Rocky Linux 8 : firefox (RLSA-2021:5013)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:5013 advisory. - Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported...

Rocky Linux 8 : thunderbird (RLSA-2021:5045)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:5045 advisory. - Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported...