266 matches found
CVE-2021-45711
An issue was discovered in the simpleasn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f...
CVE-2021-45694
An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations...
CVE-2021-45689
An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfxauxil::readspirv may read from uninitialized memory locations...
CVE-2021-45700
An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service Nervos CKB blockchain node crash via a dead call that is used as a DepGroup...
CVE-2021-45687
An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...
CVE-2021-45702
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free...
CVE-2021-45701
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free...
CVE-2021-45682
An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations...
[SECURITY] Fedora 34 Update: rust-tiny_http0.6-0.6.4-1.fc34
Low level HTTP server library...
acid-store (>=0.1.0, <=0.14.2), actaeon (>=0.1.1, <=0.2.1) +207 more potentially affected by unknown CVE via sodiumoxide (>=0.0.4, <=0.2.7)
sodiumoxide CARGO version =0.0.4, =0.1.0, =0.1.1, =0.1.0, =0.6.2, =0.6.2, =0.6.1, =0.6.2, =0.15.2, =0.1.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0137...
Wrong type for `Linker`-define functions when used across two `Engine`s
Impact As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of...
CVE-2021-39219
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should...
CVE-2021-39219 Wrong type for `Linker`-define functions when used across two `Engine`s
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should...
CVE-2021-39219
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should...
GHSA-M833-JV95-MFJH Memory safety violation in crayon
An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike...
Denial Of Service (DoS)
library/std/src/net/parser.rs in Rust is vulnerable to denial of service. It does not properly consider extraneous zero characters at the beginning of an IP address string, which in some situations allows attackers to bypass access control that is based on IP addresses, because of unexpected octa...
Alexcrichton Tar-rs 路径遍历漏洞
Alexcrichton Tar-rs is a tar archive read/write library for Rust. A path traversal vulnerability exists in Alexcrichton Tar-rs, which stems from a logical error in the implementation of the product's decompression feature, and could allow an attacker to create files in other directories by...
CVE-2021-38196
An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...