matrix-qrcode (0.3.0), matrix-sdk-base (>=0.5.0, <=0.5.1) +5 more potentially affected by CVE-2024-40640 via vodozemac (>=0.2.0, <=0.3.0)

vodozemac CARGO version =0.2.0, =0.5.0, =0.3.0, =0.4.0 - matrix-sdk-sled 0.1.0 - matrix-sdk-sql 0.1.0-beta.2 Source cves: CVE-2024-40640 Source advisory: OSV:RUSTSEC-2024-0354...

CBL Mariner 2.0 Security Update: libgit2 / rust (CVE-2023-22742)

The version of libgit2 / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-22742 advisory. - libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with t...

actix-session-surrealdb (>=0.1.0, <=0.1.5), bb8-surrealdb (>=0.1.0, <=0.1.3) +2 more potentially affected by CVE-2024-58363 via surrealdb (1.0.0-beta.9)

surrealdb CARGO version 1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-58363 Source advisory: OSV:GHSA-GH9F-6XM2-C4J2...

CVE-2024-39697

phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a...

CVE-2024-39697 phonenumber panics on parsing crafted phonenumber inputs

phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a...

GHSA-MJW4-JJ88-V687 panic on parsing crafted phonenumber inputs

Impact The phonenumber parsing code may panic due to a reachable assert! guard on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form...

panic on parsing crafted phonenumber inputs

Impact The phonenumber parsing code may panic due to a reachable assert! guard on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form...

[SECURITY] Fedora 40 Update: rust-sequoia-gpg-agent-0.4.2-1.fc40

A library for interacting with GnuPG's gpg-agent...

[SECURITY] Fedora 39 Update: rust-sequoia-sq-0.37.0-3.fc39

Command-line frontends for Sequoia...

[SECURITY] Fedora 39 Update: rust-sequoia-openpgp-1.21.1-1.fc39

OpenPGP data types and associated machinery...

[SECURITY] Fedora 39 Update: rust-sequoia-gpg-agent-0.4.2-1.fc39

A library for interacting with GnuPG's gpg-agent...

Fedora 40 : rust-sequoia-chameleon-gnupg / rust-sequoia-gpg-agent / etc (2024-12f0caa904)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-12f0caa904 advisory. - Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. - Update the sequoia-keystore crate to version 0.5.1. - Update the...

Fedora 39 : rust-sequoia-chameleon-gnupg / rust-sequoia-gpg-agent / etc (2024-029752e60b)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-029752e60b advisory. - Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. - Update the sequoia-keystore crate to version 0.5.1. - Update the...

ayaka-model (0.2.0), ayaka-runtime (0.2.0) +16 more potentially affected by unknown CVE via zerovec-derive (>=0.6.0, <=0.8.0)

zerovec-derive CARGO version =0.6.0, =0.6.0, =1.0.0-beta1 - icuproviderblob 1.0.0-beta1 - icusegmenter 1.0.0-alpha1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-74R5-G7VC-J2V2...

zerovec-derive incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

GHSA-74R5-G7VC-J2V2 zerovec-derive incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

GHSA-XRV3-JMCP-374J zerovec incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

ayaka-model (0.2.0), ayaka-runtime (0.2.0) +26 more potentially affected by unknown CVE via zerovec (>=0.2.3, <=0.8.1)

zerovec CARGO version =0.2.3, =0.3.0, =0.6.0, =1.0.0-beta1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XRV3-JMCP-374J...

zerovec incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

OESA-2024-1812 rust security update

Rust is a systems programming language focused on three goals:safety, speed,and concurrency.It maintains these goals without having a garbage collector, making it a useful language for a number of use cases other languages are not good at: embedding in other languages, programs with specific spac...