SUSE-SU-2025:03092-1 Security update for rav1e

This update for rav1e fixes the following issues: - Update crate shlex to 1.3.0: CVE-2024-58266: Fixed command injection bsc1247207 RUSTSEC-2024-0006: Fixed multiple issues involving quote API bsc1230028...

CVE-2025-53605 affecting package rust for versions less than 1.86.0-4

CVE-2025-53605 affecting package rust for versions less than 1.86.0-4. A patched version of the package is available...

CVE-2025-53605 affecting package rust for versions less than 1.75.0-17

CVE-2025-53605 affecting package rust for versions less than 1.75.0-17. A patched version of the package is available...

a2d (>=0.1.0, <=0.1.11), aa2nucaln (0.1.1) +2184 more potentially affected by unknown CVE via fxhash (>=0.1.2, <=0.2.1)

fxhash CARGO version =0.1.2, =0.1.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1-dev.10, =0.1.0, =0.37.1, =0.1.1, =0.0.1, =0.1.1, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0057...

a2d (>=0.1.0, <=0.1.11), abscissa (>=0.6.0-beta.1, <=0.6.0-rc.0) +1101 more potentially affected by unknown CVE via adler (>=0.2.3, <=1.0.2)

adler CARGO version =0.2.3, =0.1.0, =0.6.0-beta.1, =0.6.0-beta.1, =0.6.0-beta.1, =0.1.5, =0.0.1-dev.10, =0.4.0, =0.2.0, =0.1.0, =0.2.0, =0.1.13, =0.1.0, =0.3.0, =0.1.0, =0.9.1, =0.13.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0056...

Rust Privilege Escalation

The vulnerability of the Rust programming language is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2025-58359 frost-core: refresh shares with smaller min_signers will reduce group security

ZF FROST is a Rust implementation of FROST Flexible Round-Optimised Schnorr Threshold signatures. In versions 2.0.0 through 2.1.0, refresh shares with smaller minsigners will reduce security of group. The inability to change minsigners i.e. the threshold with the refresh share functionality...

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

...

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

...

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.

...

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

...

Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

...

CVE-2025-57611

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 Null pointer dereference vulnerability in the dump method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check the return value of avfiltergraphdump for NULL, leading to a crash...

CVE-2025-57612

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 Null pointer dereference vulnerability in the name method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check for a NULL return value from the avgetsamplefmtname C function,...

CVE-2025-57615

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 An integer overflow vulnerability in the Vector::new constructor function allows an attacker to cause a denial of service via a null pointer dereference. The vulnerability stems from an unchecked cast of a usize parameter to cint,...

Amazon Linux 2 : rust, --advisory ALAS2-2025-2978 (ALAS-2025-2978)

The version of rust installed on the remote host is prior to 1.86.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2978 advisory. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns...

Medium: rust

Issue Overview: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. CVE-2025-6965 Affected Packages: rust...

rust openssl ssl::select_next_proto use after free

...

Fedora 44 : glycin / rust-ashpd / rust-ashpd0.11 / rust-glycin / etc (2025-bb172624a9)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-bb172624a9 advisory. Update glycin to version 2.0.rc. This update also includes a bunch of related Rust dependency updates for GNOME 49.rc. Additionally, CVE-2025-58160 is...

CVE-2025-57614

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 Integer overflow and invalid input vulnerability in the cached method allows an attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability occurs when dimension parameters are zero or exceed...