RUSTSEC-2021-0032 Deserializing an array can drop uninitialized memory on panic

The readbytesdefaultle function for T; n arrays, used to deserialize arrays of T from bytes created a T; n array with std::mem::uninitialized and then called T's deserialization method. If T's deserialization method panicked, the uninitialized memory could drop invalid objects. This flaw was...

Deserializing an array can drop uninitialized memory on panic

The readbytesdefaultle function for T; n arrays, used to deserialize arrays of T from bytes created a T; n array with std::mem::uninitialized and then called T's deserialization method. If T's deserialization method panicked, the uninitialized memory could drop invalid objects. This flaw was...

QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c

A reachable assertion vulnerability was found in the USB EHCI emulation code of QEMU. This issue occurs while processing USB requests due to missed handling of DMA memory map failure. This flaw allows a malicious privileged user within the guest to send bogus USB requests and crash the QEMU proce...

`through` and `through_and` causes a double free if the map function panics

through and throughand take a mutable reference as well as a mapping function to change the provided reference. They do this by calling ptr::read on the reference which duplicates ownership and then calling the mapping function. If the mapping function panics, both the original object and the one...

RUSTSEC-2021-0049 `through` and `through_and` causes a double free if the map function panics

through and throughand take a mutable reference as well as a mapping function to change the provided reference. They do this by calling ptr::read on the reference which duplicates ownership and then calling the mapping function. If the mapping function panics, both the original object and the one...

Creepy - A Geolocation OSINT Tool. Offers Geolocation Information Gathering Through Social Networking Platforms

This project is currently not maintained. I haven't put any work on it since 2016 and with the current state of the API access to instagram and twitter, and the default settings for their geolocation features cree.py wouldn't be of much use. I will live the repository and site up for the time but...

Qualcomm Graphics Access Control Error Vulnerability

Qualcomm Graphics is a Qualcomm graphics support firmware for use on processors. A security vulnerability exists in Qualcomm Graphics that stems from the use of mmap, where the kgsl driver has a special offset value that can be supplied to map the GPU memstore to user space...

In libsndfile version 1.0.28 an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.

...

CVE-2021-25902

An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, maparray can perform a double drop...

The vulnerability of the dev_map_read function in the input/output tracing utility Blktrace allows a attacker to cause a service failure.

The vulnerability of the devmapread function in the Blktrace input/output tracing utility is related to the operation of pushing the output data beyond the allowable buffer size in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

ALPINE-CVE-2020-14360

A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Design/Logic Flaw

An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations in safe code...

CVE-2020-35905

The CVE-2020-35905 issue affects the futures-util crate for Rust (pre-0.3.7). A MutexGuard::map path can cause a data race in safe code under certain closure scenarios. This is a local issue in the crate’s synchronization logic that could lead to data races, as described in the advisory and Red H...

Rust 资源管理错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in http crate in versions of Mozilla Rust prior to 0.1.20, which stems from HeaderMap:: The Drain API can use raw pointers to corrupt sound effects. No details of the vulnerabilit...

Rust Input Validation Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. An input validation error vulnerability exists in Rust http crate before 0.1.20, which stems from an integer overflow in HeaderMap::reserve, allowing an attacker to cause a denial of service...

Rust Competition Condition Problem Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust futures-util crate before 0.3.7, which stems from the fact that MutexGuard::map can lead to data contention in certain closure cases in safe code...

UBUNTU-CVE-2020-35711

An issue has been discovered in the arc-swap crate before 0.4.8 and 1.x before 1.1.0 for Rust. Use of arcswap::access::Map with the Constant test helper or with a user-supplied implementation of the Access trait could sometimes lead to dangling references being returned by the map...

Rust Code Issues Vulnerabilities

Rust is a general-purpose, compiled programming language. A security vulnerability exists in Rust versions prior to 0.4.8 and versions prior to 1.1.0 of the 1.x series, which stems from the use of arc swap::access::Map and the Constant test helper or the use of a user-supplied implementation of t...

[ASA-202012-26] qemu: multiple issues

Arch Linux Security Advisory ASA-202012-26 ========================================== Severity: Medium Date : 2020-12-16 CVE-ID : CVE-2020-14364 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723 CVE-2020-28916 Package : qemu Type : multiple issues Remote : No Link :...

xorg-x11-server: Out-of-bounds access in XkbSetMap function

A flaw was found in the X.Org Server. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...