CVE-2023-25568 Boxo bitswap/server: DOS unbounded persistent memory leak

Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affects users acceptin...

Mitigation Confirmed for Mitigation of M-10: Issue mitigated

Mitigated issue M-10: Stuck ether when use function stake with empty derivativesderivativeCount = 0 The issue was that stake will accept payment but not issue safETH when derivativeCount == 0 or when all weightsi == 0. Mitigation review The proposed mitigation simply adds a requirederivativeCount...

Unnecessary precision loss in redeemKIBT()

Lines of code Vulnerability details Impact Unnecessary precision loss in redeemKIBT Proof of Concept If enter Deprecated mode, user can switch back to StableCoin by percentage with redeemKIBT The redeemKIBT implementation code is as follows: function redeemKIBTuint256 amount external override...

SUSE CVE-2019-19807

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to sndtimeropen and sndtimercloselocked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a...

Deficiency of slashed GGP amount should be made up from node operator's AVAX

Lines of code Vulnerability details Impact If staked GGP doesn't cover slash amount, slashing it all will not be fair to the liquid stakers. Slashing is rare, and that the current 14 day validation cycle which is typically 1/26 of the minimum amount of GGP staked is unlikely to bump into this...

PT-2025-13356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow issue was detected in the Linux kernel, specifically in the bnxt module, where test names were being concatenated beyond the end of the first name. This issue was...

Underlying With Non-Standard Decimals Not Supported

Lines of code Vulnerability details Impact Arithmetic operations are performed with the assumption that the token always has 18 decimals. Proof of Concept It would not be possible without using 18 decimal places of the base capital. Tools Used vscode Recommended Mitigation Steps Consider whether...

guestfs-tools security, bug fix, and enhancement update

1.48.2-5 - Rebase to guestfs-tools 1.48.2 resolves: rhbz2059286 - Default to --selinux-relabel in various tools resolves: rhbz2075718, rhbz2089748 - Add lvm system.devices cleanup operation to virt-sysprep resolves: rhbz2072493 - Refactor virt-customize --install, --update options in common...

Fixed CVE-2022-28614 in httpd

CVE-2022-28614: fix out-of-bounds read via aprwrite, refactoring...

Divide before multiply may create unexpected values on interests

Lines of code Vulnerability details Divide before multiply may create unexpected values on interests Impact Solidity integer division might truncate. As a result, performing divide before multiply can sometimes create loss of precision. Details If for example we have an operation: 2/33 The expect...

Security update for neomutt (moderate)

openSUSE Security Update: Security update for neomutt Announcement ID: openSUSE-SU-2022:10020-1 Rating: moderate References: 1184787 1185705 Cross-References: CVE-2021-32055 CVE-2022-1328 CVSS scores: CVE-2021-32055 NVD : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2021-32055 SUSE: 5.3...

Malicious code in dropins_sdk_refactor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9e787eda579a54454ff7a74a1dd8a064c21afb3b9bb46355d5834f9b03ddbd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GSD-2022-1000600 Bluetooth: refactor malicious adv data check

Bluetooth: refactor malicious adv data check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.5 by commit...

GSD-2022-1000240 Bluetooth: refactor malicious adv data check

Bluetooth: refactor malicious adv data check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...

GSD-2022-1000181 Bluetooth: refactor malicious adv data check

Bluetooth: refactor malicious adv data check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.96 by commit...

GSD-2022-1000120 Bluetooth: refactor malicious adv data check

Bluetooth: refactor malicious adv data check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.228 by commit...

GSD-2022-1000096 Bluetooth: refactor malicious adv data check

Bluetooth: refactor malicious adv data check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.265 by commit...

GSD-2022-1000078 Bluetooth: refactor malicious adv data check

Bluetooth: refactor malicious adv data check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.300 by commit...

CLSA-2022-1644501113 Fix CVE(s): CVE-2021-44142

SECURITY UPDATE: code exec via out-of-bounds read/write in vfsfruit - debian/patches/CVE-2021-44142.patch: refactor getentry function in order to add additional checks - CVE-2021-44142...

Unbounded loops

Handle paulius.eth Vulnerability details Impact Unbounded for loops may exceed gas limit. There are several places where iterations over dynamically sized arrays take place. For example, function removeNft iterates over all the NFTs and tries to find the one that is needed to be removed. However,...