rust-crossbeam-deque: race condition may lead to double free

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

PT-2021-24283 · Crypto2 · Crypto2

Name of the Vulnerable Software and Affected Versions: crypto2 crate through 2021-10-08 for Rust Description: An issue was discovered in the crypto2 crate that affects Chacha20 encryption and decryption. The implementation does not enforce alignment requirements on input slices, incorrectly...

acari-lib (>=0.1.1, <=0.1.8), accepted (>=0.2.0, <=0.3.2) +1862 more potentially affected by unknown CVE via traitobject (>=0.0.1, <=0.1.1)

traitobject CARGO version =0.0.1, =0.1.1, =0.2.0, =0.0.6, =0.0.7-alpha.3, =0.0.7-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.4.2 - aigcapi 5.1.2 - aigcchain 5.1.2 - aigcconfig 5.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0144...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +36 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.7.0, <=0.29.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.0, =0.8.0-alpha.2, =0.8.0-alpha.2, =0.1.1, =0.1.1, =0.1.2, =0.1.4 and more Source cves: CVE-2021-39216, CVE-2021-39218, CVE-2021-39219 Source advisory: OSV:GHSA-Q879-9G95-56MX...

ceres-executor (>=0.1.0, <=0.2.0), inkpad-executor (0.1.0) +21 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.26.1, <=0.29.0)

wasmtime CARGO version =0.26.1, =0.1.0, =0.2.0, =0.1.2, =0.2.2, =0.3.0, =0.28.0, =0.26.0, =0.26.0, =0.27.0 and more Source cves: CVE-2021-39216, CVE-2021-39218, CVE-2021-39219 Source advisory: OSV:GHSA-4873-36H9-WV49...

afterburn (4.1.0), aoaddons (>=0.1.1, <=0.1.6) +50 more potentially affected by CVE-2019-25054 via pnet (>=0.12.0, <=0.26.0)

pnet CARGO version =0.12.0, =0.1.1, =0.0.2, =0.6.0, =0.1.0, =1.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.3.1, =0.4.0 and more Source cves: CVE-2019-25054 Source advisory: OSV:GHSA-R6FF-2Q3C-V3PV...

hwatch (0.1.5) potentially affected by CVE-2019-15547 +1 more via ncurses (5.94.0)

ncurses CARGO version 5.94.0 is affected by a known vulnerability. The following packages have a transitive dependency on ncurses and may be impacted: - hwatch 0.1.5 Source cves: CVE-2019-15547, CVE-2019-15548 Source advisory: OSV:GHSA-32V7-GHPR-C8HG...

orbtk (>=0.3.0-alpha-1, <=0.3.1-alpha2), orbtk-api (>=0.3.0-alpha1, <=0.3.1-alpha2) +2 more potentially affected by CVE-2020-36459 via dces (0.2.0)

dces CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dces and may be impacted: - orbtk =0.3.0-alpha-1, =0.3.0-alpha1, =0.3.0-alpha1, =0.3.0-alpha1, =0.3.1-alpha2 Source cves: CVE-2020-36459 Source advisory: OSV:GHSA-HXW9-JXQW-JC8J...

Use after free in libpulse-binding

Overview Version 1.2.1 of the libpulse-binding Rust crate, released on the 15th of June 2018, fixed a pair of use-after-free issues with the objects returned by the getformatinfo and getcontext methods of Stream objects. These objects were mistakenly being constructed without setting an important...

a2 (>=0.5.0-alpha.6, <=0.5.0-alpha.7), anitable (0.1.0) +66 more potentially affected by CVE-2021-21299 via hyper (>=0.13.0-alpha.1, <=0.13.7)

hyper CARGO version =0.13.0-alpha.1, =0.5.0-alpha.6, =0.1.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.31.1 and more Source cves: CVE-2021-21299 Source advisory: OSV:GHSA-6HFQ-H8HQ-87MF...

artano (0.2.6), bbox (>=0.7.0, <=0.8.2) +132 more potentially affected by CVE-2020-36465 via generic-array (0.8.4)

generic-array CARGO version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on generic-array and may be impacted: - artano 0.2.6 - bbox =0.7.0, =0.4.0-beta, =0.1.1, =0.2.0, =1.0.0, =0.1.0, =0.2.0, =0.2.0, =0.6.0-rc1, =0.2.0, =0.3.1 and more Source...

requeuest (>=0.1.1, <=0.2.1), sqlxmq (>=0.2.0, <=0.2.1) potentially affected by CVE-2021-38191 via tokio (1.8.0)

tokio CARGO version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - requeuest =0.1.1, =0.2.0, =0.2.1 Source cves: CVE-2021-38191 Source advisory: OSV:GHSA-2GRH-HM3W-W7HV...

abbegm (>=0.1.0, <=0.5.0), acacia (0.2.0) +565 more potentially affected by CVE-2021-38190 via nalgebra (>=0.11.2, <=0.26.2)

nalgebra CARGO version =0.11.2, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.2.0, =0.11.0, =0.2.0, =0.1.0, =0.3.0 and more Source cves: CVE-2021-38190 Source advisory: OSV:GHSA-3W8G-XR3F-2MP8...

evm (>=0.13.0, <=0.20.0), evm-gasometer (>=0.13.0, <=0.20.0) +2 more potentially affected by unknown CVE via evm-core (>=0.13.1, <=0.20.0)

evm-core CARGO version =0.13.1, =0.13.0, =0.13.0, =0.13.0, =2.0.0-alpha.3, =2.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-773Q-5334-5GF9...

blob (>=0.1.0, <=0.1.1), buzz (>=0.2.0, <=1.0.4) +51 more potentially affected by CVE-2017-1000430 via base64 (>=0.1.1, <=0.4.2)

base64 CARGO version =0.1.1, =0.1.0, =0.2.0, =0.1.4, =0.1.0, =0.5.1, =0.1.0, =0.1.9, =0.3.0, =0.2.0, =0.3.2, =0.1.0, =0.4.0, =0.1.0, =0.1.0, =0.4.0 and more Source cves: CVE-2017-1000430 Source advisory: OSV:GHSA-X67X-VG9M-65C3...

af-core (>=0.1.0, <=0.1.8), af-lib (0.1.1) +49 more potentially affected by CVE-2021-1000007 +1 more via parse_duration (2.1.1)

parseduration CARGO version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on parseduration and may be impacted: - af-core =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.2, =0.6.2, =0.6.2, =0.1.0, =0.3.12, =0.1.0, =0.1.0, =1.0.0-alpha.3, =1.0.0-alpha.4 and...

booklibrs (>=0.1.0, <=1.0.4), fl2rust (0.3.1) +5 more potentially affected by CVE-2021-28306 +2 more via fltk (>=0.9.7, <=0.14.13)

fltk CARGO version =0.9.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =0.9.15 Source cves: CVE-2021-28306, CVE-2021-28307, CVE-2021-28308 Source advisory: OSV:GHSA-7QCC-G2M9-8533...

buf (>=0.1.0, <=0.2.1), i-o (>=0.1.0, <=0.4.1) +2 more potentially affected by CVE-2021-25907 via containers (>=0.1.1, <=0.8.5)

containers CARGO version =0.1.1, =0.1.0, =0.1.0, =0.13.0, =0.14.1 - lude 0.1.0 Source cves: CVE-2021-25907 Source advisory: OSV:GHSA-CV7X-6RC6-PQ5V...

GHSA-8GF5-Q9P9-WVMC Data race in atomic-option

An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption implements Sync unconditionally, a data race can occur...

epoll (>=0.4.0, <=0.6.0), hydrogen (>=0.1.0, <=0.1.5) potentially affected by CVE-2020-35892 +1 more via simple-slab (>=0.1.0, <=0.2.3)

simple-slab CARGO version =0.1.0, =0.4.0, =0.1.0, =0.1.5 Source cves: CVE-2020-35892, CVE-2020-35893 Source advisory: OSV:GHSA-438G-FX34-4H9M...