266 matches found
[SECURITY] Fedora 44 Update: rust-astral_async_http_range_reader-0.10.0-1.fc44
A library for streaming reading of files over HTTP using range requests...
EUVD-2026-13596
tar-rs incorrectly ignores PAX size headers if header size is nonzero...
AZL-80523 CVE-2026-33056 affecting package trident for versions less than 0.22.0-1
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...
AZL-80511 CVE-2026-33056 affecting package rust for versions less than 1.90.0-7
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...
AZL-80499 CVE-2026-33056 affecting package rpm-ostree for versions less than 2024.4-10
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...
AZL-80315 CVE-2026-33056 affecting package tardev-snapshotter 3.2.0.tardev1-10
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...
AZL-83037 CVE-2026-33056 affecting package clamav for versions less than 1.5.2-2
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...
AZL-80505 CVE-2026-33055 affecting package rust for versions less than 1.75.0-28
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...
AZL-80496 CVE-2026-33055 affecting package rpm-ostree for versions less than 2024.4-10
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...
AZL-83034 CVE-2026-33055 affecting package clamav for versions less than 1.5.2-2
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...
CVE-2026-33055
CVE-2026-33055 affects the tar-rs crate (Rust tar library) version 0.4.44 and below, where conditional logic incorrectly skipped the PAX size header when the base header size was nonzero. This contrasts with other parsers that use the PAX size override, potentially causing archives to appear diff...
CVE-2026-33055 tar-rs incorrectly ignores PAX size headers if header size is nonzero
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...
CVE-2026-32829
lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values...
UBUNTU-CVE-2026-32829
lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values...
tar-rs 安全漏洞
tar-rs is a Rust library for reading and writing tar archive files, developed by Alex Crichton. Versions of tar-rs prior to 0.4.44 contain security vulnerabilities. These vulnerabilities stem from defects in the unpackdir function, which handles symbolic links. Such defects could lead to arbitrar...
PT-2026-26570
Name of the Vulnerable Software and Affected Versions tar-rs versions 0.4.44 and below Description tar-rs, a Rust library for reading and writing tar archives, contains a flaw in its handling of PAX size headers. Specifically, versions 0.4.44 and below have conditional logic that skips the PAX si...
ffmpeg 安全漏洞
FFmpeg is a Rust library developed by a single developer. Versions 8.0 and 8.0.1 of FFMPEG contain security vulnerabilities, which stem from an oversight in the validation of quantization parameters. These vulnerabilities may lead to out-of-bounds reads, memory leaks, or system crashes...
CVE-2026-30960
rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT Just-In-Time compilation engine, which is fully exposed via the CFFI Foreign Functi...
EUVD-2026-10704
rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT Just-In-Time compilation engine, which is fully exposed via the CFFI Foreign Functi...