12408 matches found
CVE-2025-22620
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...
UBUNTU-CVE-2025-22620
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...
CVE-2025-22620
Summary: CVE-2025-22620 affects gitoxide’s gix-worktree-state, where one checkout strategy can apply 0777 permissions to executable files in Unix-like systems, bypassing the umask and potentially making files world-writable. This occurs in the checkout logic depending on destination_is_initially_...
CVE-2025-22620
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...
CVE-2025-22620: Improper Preservation of Permissions
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...
GitOxide security vulnerabilities
gitoxide is a git implementation written in Rust by the individual developer Sebastian Thiel. A security vulnerability exists in gitoxide versions prior to 0.17.0, which stems from the fact that files in the repository are globally writable under certain circumstances...
GHSA-C873-WFHP-WX5M SP1 has missing verifier checks and fiat-shamir observations
In SP1’s STARK verifier, the prover provided chipordering is used to fetch the index of the chips that have preprocessed columns. Prior to v4.0.0, the validation that this chipordering correctly provides these indexes was missing. In v4.0.0, this was fixed by adding a check that the indexed chip’...
SP1 has missing verifier checks and fiat-shamir observations
In SP1’s STARK verifier, the prover provided chipordering is used to fetch the index of the chips that have preprocessed columns. Prior to v4.0.0, the validation that this chipordering correctly provides these indexes was missing. In v4.0.0, this was fixed by adding a check that the indexed chip’...
acct (>=0.2.0, <=0.5.0), almel (>=1.0.0, <=1.4.7) +179 more potentially affected by CVE-2025-5791 via users (>=0.8.1, <=0.11.0)
users CARGO version =0.8.1, =0.2.0, =1.0.0, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.9.0, =0.2.4, =0.1.0, =0.4.2, =0.4.0, =0.7.4, =0.1.4, =0.8.2, =0.8.3 and more Source cves: CVE-2025-5791 Source advisory: OSV:RUSTSEC-2025-0040...
PT-2025-24273
Name of the Vulnerable Software and Affected Versions user's crate for Rust affected versions not specified Description A flaw was found in the user's crate for Rust, allowing privilege escalation via incorrect group listing. This occurs when a user or process has fewer than exactly 1024 groups,...
accountnovafi (>=0.1.0, <=0.2.0), accountnovafi1 (0.1.0) +708 more potentially affected by unknown CVE via libsecp256k1 (>=0.1.3, <=0.7.2)
libsecp256k1 CARGO version =0.1.3, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.3.0, =0.3.2, =0.3.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0161...
htmlentity (>=0.1.0, <=1.2.0), reddb (0.2.0) +2 more potentially affected by unknown CVE via grcov (>=0.5.15, <=0.8.13)
grcov CARGO version =0.5.15, =0.1.0, =0.1.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0005...
avery (>=0.1.0, <=0.7.1), bibjoin (>=0.1.2, <=0.2.1) +64 more potentially affected by unknown CVE via fast-float (0.2.0)
fast-float CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fast-float and may be impacted: - avery =0.1.0, =0.1.2, =0.1.0, =0.13.0, =0.19.0, =0.4.1, =0.6.2, =0.3.2, =0.4.1, =0.3.2, =0.3.2, =0.1.0, =1.0.8, =1.1.0 and more Source cves...
RUSTSEC-2025-0002 Segmentation fault due to lack of bound check
In this case, the "fastfloat2::common::AsciiStr::first" method within the "AsciiStr" struct uses the unsafe keyword to reading from memory without performing bounds checking. Specifically, it directly dereferences a pointer offset by "self.ptr". Because of the above reason, the method accesses...
Segmentation fault due to lack of bound check
In this case, the "fastfloat2::common::AsciiStr::first" method within the "AsciiStr" struct uses the unsafe keyword to reading from memory without performing bounds checking. Specifically, it directly dereferences a pointer offset by "self.ptr". Because of the above reason, the method accesses...
PT-2025-5674
Name of the Vulnerable Software and Affected Versions: fast-float affected versions not specified Description: The issue arises from the fast float::common::AsciiStr::first method within the AsciiStr struct, which uses the unsafe keyword to read from memory without performing bounds checking. It...
CVE-2021-46023 affecting package rust 1.72.0-15
CVE-2021-46023 affecting package rust 1.72.0-15. This CVE either no longer is or was never applicable...
CVE-2022-4450 affecting package rust 1.59.0-1
CVE-2022-4450 affecting package rust 1.59.0-1. This CVE either no longer is or was never applicable...