CLSA-2023-1693420133 Update of alt-php

Fixed possible memory leak - debian/patches/fix-possible-memory-leak.patch: added DestroyDrawInfo call when StringToList returns error...

OESA-2023-1516 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of format over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

OESA-2023-1517 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of format over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

CVE-2023-39978

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw...

SUSE CVE-2023-39978

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw...

CVE-2023-39978

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw...

CVE-2023-39978

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw...

UBUNTU-CVE-2023-39978

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw...

ImageMagick Security Vulnerability

ImageMagick is a set of open-source image processing software from the American company ImageMagick. The software can read, convert, or write images in a variety of formats. A security vulnerability exists in versions prior to ImageMagick 6.9.12-91, which stems from a vulnerability that allows an...

CVE-2023-39978

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw...

PT-2023-8782 · Unknown +2 · Imagemagick +2

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 6.9.12-91 Description: The issue is related to the Magick::Draw function in the ImageMagick console graphic editor, which is associated with memory release errors. Exploitation of this issue can allow an attacker...

function rngComplete is unpprotected

Lines of code Vulnerability details Impact The rngComplete is a function Called by the relayer to complete the Rng relay auction. However it has zero access control. Proof of Concept The function makes calls to the prizepool to close a draw, it also withdraws from a reserve. All these are done wi...

Closing the draw will be compromised if the recipient reward is address(0)

Lines of code Vulnerability details Impact The rngComplete function receives the RNG request results, it closes the draw using the randomNumber generated by the RNG request auction and it transfer the rewards. The problem is that a malicious actor can introduce a address zero in the recipient...

Missing access control in RngRelayAuction::rngComplete()

Lines of code Vulnerability details For a draw auction to complete, a bot must relay a completed RNG result to the Prize Pool. This is done by calling rngComplete and the data must originate from the relayer. However the rngComplete function is missing a check that the msg.sender is the relayer s...

Upgraded Q -> 2 from #422 [1689707351452]

Judge has assessed an item in Issue 422 as 2 risk. The relevant finding follows: 01 In the function PrizePool.setDrawManager, anyone can frontrun it and become the drawManager Reading the documentation of the Prize Pool contract, the following is specified: The Prize Pool allows a 'draw manager'...

Unsecure and predictable random number generation in closeDraw.winningRandomNumber_()

Lines of code Vulnerability details Impact Unsecure and predictable random number generation in closeDraw.winningRandomNumber can lead to external influence by malicious attackers. Leading to undermining of the fairness and security and unpredictability of the draw function. Both the timestamp an...

CVE-2023-2764

The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsetfeaturedimage function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with subscriber-level permissions and...

CVE-2023-2764

The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsetfeaturedimage function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with subscriber-level permissions and...

CVE-2023-2764

The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsetfeaturedimage function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with subscriber-level permissions and...

Design/Logic Flaw

The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsetfeaturedimage function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with subscriber-level permissions and...