CVE-2023-5633

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 6.4.16 and fixes or adds mitigations for atleast the following security issues: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often...

CVE-2023-4921

A use-after-free flaw was found in qfqdequeue and aggdequeue in net/sched/schqfq.c in the Traffic Control QoS subsystem in the Linux kernel. This issue may allow a local user to crash the system or escalate their privileges on the system. Mitigation Mitigation for this issue is to skip loading th...

Advisory ROSA-SA-2023-2277

software: ffmpeg 4.4.3 OS: ROSA-CHROME packageevrstring: ffmpeg-4.4.3-2.src.rpm CVE-ID: CVE-2022-3109 BDU-ID: 2023-04787 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the vp3decodeframe function of the libavcodec/vp3.c component of the FFmpeg multimedia library is related to a lack of validation o...

PT-2023-7566 · Iterm2 · Iterm2

Name of the Vulnerable Software and Affected Versions: iTerm2 versions prior to 3.4.20 Description: The issue is related to the mishandling of certain escape sequences related to upload, which can allow potentially remote code execution. This is due to a lack of proper output encoding or escaping...

CVE-2023-45677

CVE-2023-45677 affects stb_vorbis used by SDL2_sound/stb_vorbis.c. A crafted file can trigger a heap out-of-bounds write via f->vendor[len] = (char) '\0' with a negative len during start_decoder, and an integer overflow when len is INT_MAX during allocation of f->vendor and comment_list[i]....

ilogistics.ee Cross Site Scripting vulnerability OBB-3757106

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Incorrect Authorization in Vmware Aria_Operations_For_Logs

CVE-2023-34051 CVE-2023-34051 is an authentication bypass tha...

CVE-2023-43622

A flaw was found in the modhttp2 module of httpd. This flaw allows an attacker opening an HTTP/2 connection with an initial window size of 0 to block handling of that connection indefinitely. This vulnerability can exhaust worker resources in the server, similar to the well-known "slow loris"...

number of txs of excutors must be excutores + 1 but this loop will +1 in every cycle

Lines of code Vulnerability details Impact number of txns of excutors must be excutores + 1 but this loop will +1 in every cycle the code structure is designed the way the number of txns of excutors in enableExecutorPluginOnSubAccount function counts the length of executors txns and it should be...

Account should be able to add max time it would want its transaction to be executed.

Lines of code Vulnerability details Impact Account is not allowed to specify the expiration time for its request execution, since most request run arbitrary calls, which might be time bound. Proof of Concept Alot of transaction or calls on the blockchain are time bound, lets say for example Alice...

Console account cannot execute a transaction on a sub account unless it registers itself as an executor

Lines of code Vulnerability details The Executor is an account authorized to make module transactions on a subAccount via ExecutorPlugin. The executor is assigned/registered by the subaccount created by the console account. But the console account itself cannot execute the transaction & is...

FallbackHandler remains unset in _setupConsoleAccount()

Lines of code Vulnerability details Impact According to the docs, the fallback handler provides compatibility between pre-1.3.0 and 1.3.0+ Safe contracts, and additionally, also ensures policy validation guarantees required for ConsoleAccounts/SubAccounts that have policy validation enabled. If n...

A new executor cannot be added because of the wrong restriction

Lines of code Vulnerability details Impact A new executor cannot be added because of the wrong restriction Proof of Concept if !subAccountToExecutorssubAccount.addexecutor revert AlreadyExists; The if statement checks if executor to be added to the subAccountToExecutors mapping is not in the...

Nonce is not incremented after using signature for policy validation

Lines of code Vulnerability details Impact Nonce is not incremented after using signature for policy validation Proof of Concept In PolicyValidator.sol there is a function function isPolicySignatureValid address account, address to, uint256 value, bytes memory data, Enum.Operation operation, byte...

disallowing the executor to sign the transaction with the expiryEpoch will may allow or prevent the transaction to be executed in a wrong time for the executor, who is the responsible for performing the strategies, and will hamper the automation process

Lines of code Vulnerability details Impact preventing the executor from setting an ExpiryEpoch to the transaction to be executed within it , will lead to hamper the automation process and may allow the transactions to be executed in improper time in which the strategy became invalid which may cau...

Protocol's invariants can be broken

Lines of code Vulnerability details Impact Due to insufficient input validation to the inputs of the external function "deploySubAccount" in the SafeDeployer.sol contract,A malcious subAccount wallet can be imported,registered and then take control over other subAccounts. This can cause many...

getModulesPaginated does not return the correct data

Lines of code Vulnerability details Impact In ConsoleFallbackHandler, you can call getModules to return the first 10 modules: function getModules external view returns address memory GnosisSafe safe = GnosisSafepayablemsg.sender; address memory array, = safe.getModulesPaginatedSENTINELMODULES, 10...

No proper validation of Singleton

Lines of code Vulnerability details Bug Description Operators, executors, or the Main Console account can execute transactions on behalf of a SubAccount. SubAccounts must have an enabled SafeModerator guard, which checks whether the guard and handler have not been disabled or updated, and whether...

The same console addresses on other chains can be captured by compromised or malicious owner

Lines of code Vulnerability details Impact The same order of owners addresses lets generate the same console address on all chains. But any owner from the list can deploy console accounts on other chains with threshold parameter equals 1 and then change owners in these accounts, i.e. capture thes...