certificate_authority (0.1.0), citadel_crypt (>=0.3.0, <=0.7.0) +14 more potentially affected by unknown CVE via pqc_kyber (>=0.4.0, <=0.7.1)

pqckyber CARGO version =0.4.0, =0.3.0, =0.3.0, =0.1.0-alpha, =1.3.0, =0.1.0, =11.0.0, =0.1.0, =9.0.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.19, =0.1.24 and more Source cves: unknown CVE Source advisory: OSV:GHSA-X5J2-G63M-F8G4...

anchor-token (>=0.0.1, <=0.3.0), archid-marketplace (>=1.0.5, <=1.0.8) +150 more potentially affected by CVE-2024-58264 via serde-json-wasm (>=0.1.3, <=0.4.1)

serde-json-wasm CARGO version =0.1.3, =0.0.1, =1.0.5, =1.0.0, =1.0.0, =0.3.1, =0.1.0, =2.5.2, =0.1.0, =1.0.0, =0.4.0, =1.0.0, =2.2.0 - cosmwasm-contract-migratable-std 0.1.0 and more Source cves: CVE-2024-58264 Source advisory: OSV:GHSA-RR69-RXR6-8QWF...

New Rust-Based macOS Backdoor Steals Files, Linked to Ransomware Groups

By Waqas The backdoor impersonates a Visual Studio update. This is a post from HackRead.com Read the original post: New Rust-Based macOS Backdoor Steals Files, Linked to Ransomware Groups...

a-gpt (>=0.1.0, <=0.4.0), abacuz (0.1.1) +1150 more potentially affected by CVE-2024-24575 +1 more via libgit2-sys (>=0.1.13, <=0.15.2+1.6.4)

libgit2-sys CARGO version =0.1.13, =0.1.0, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =0.1.0, =0.3.3 and more Source cves: CVE-2024-24575, CVE-2024-24577 Source advisory: OSV:RUSTSEC-2024-0013...

Use after free in libpulse-binding

Overview Version 2.5.0 of the libpulse-binding Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for which it was created...

GHSA-F56G-CHQP-22M9 Use after free in libpulse-binding

Overview Version 2.5.0 of the libpulse-binding Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for which it was created...

GHSA-WJXC-PJX9-4WVM Nervos CKB Panic on malformed input

Impact CKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages References https://github.com/BurntSushi/rust-snappy/issues/29...

Nervos CKB Unaligned Pointer Dereference

via [email protected] There are multiple type conversions in ckb that unsafely cast between byte pointers and other types of pointers. This results in unaligned pointers, which are not allowed by the Rust language, and are considered undefined behavior, meaning that the compiler is free to do...

GHSA-Q669-2VFG-CXCG Nervos CKB Unaligned Pointer Dereference

via [email protected] There are multiple type conversions in ckb that unsafely cast between byte pointers and other types of pointers. This results in unaligned pointers, which are not allowed by the Rust language, and are considered undefined behavior, meaning that the compiler is free to do...

The vulnerability of the HTTP library for Rust Hyper, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the HTTP library for Rust Hyper relates to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service failures...

fp-evm (1.0.0), fp-rpc (1.0.0) +10 more potentially affected by CVE-2021-29511 via evm (0.25.0)

evm CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on evm and may be impacted: - fp-evm 1.0.0 - fp-rpc 1.0.0 - fp-storage 1.0.0 - pallet-ethereum 1.0.0 - pallet-evm 3.0.0 - pallet-evm-precompile-blake2 1.0.0 -...

Memory over-allocation in evm crate

Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. Patches The flaw was corrected in comm...

evm (>=0.13.0, <=0.20.0), evm-gasometer (>=0.13.0, <=0.20.0) +2 more potentially affected by CVE-2021-29511 via evm-core (>=0.13.1, <=0.20.0)

evm-core CARGO version =0.13.1, =0.13.0, =0.13.0, =0.13.0, =2.0.0-alpha.3, =2.0.1 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang

Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as Faust. Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said it's being propagated by means of an infection that delivers a Microsoft Excel document .XL...

chimper (>=0.3.0, <=0.4.0), conrod_example_shared (>=0.62.0, <=0.76.1) +26 more potentially affected by unknown CVE via conrod_core (>=0.62.0, <=0.76.1)

conrodcore CARGO version =0.62.0, =0.3.0, =0.62.0, =0.0.1, =0.67.0, =0.62.0, =0.71.0, =0.1.0, =0.1.0, =0.62.0, =0.69.0, =0.62.0, =0.2.1, =0.1.0, =0.24.0, =0.1.0-docfix, =0.25.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0396...

carpo (>=0.1.2, <=0.1.3) potentially affected by unknown CVE via conrod (0.61.1)

conrod CARGO version 0.61.1 is affected by a known vulnerability. The following packages have a transitive dependency on conrod and may be impacted: - carpo =0.1.2, =0.1.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0397...

bump (0.0.0), resufancy (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via filesystem (0.4.4)

filesystem CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on filesystem and may be impacted: - bump 0.0.0 - resufancy =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0015...

oniguruma: Use-after-free in onig_new_deluxe() in regext.c

A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...

blake-streams (0.1.0), canary (>=0.0.6, <=0.1.6) +65 more potentially affected by CVE-2024-58265 via snow (>=0.1.9, <=0.9.3)

snow CARGO version =0.1.9, =0.0.6, =0.8.0, =0.1.0, =0.1.0, =0.1.5, =0.8.0, =0.10.0, =1.0.0-rc.2, =0.8.0, =0.8.0, =1.0.0-rc.1, =0.13.0-rc.1, =1.0.0-rc.1, =0.8.0, =1.0.0 and more Source cves: CVE-2024-58265 Source advisory: OSV:GHSA-7G9J-G5JG-3VV3...

objstor (>=0.4.6, <=0.4.20), rblog (>=0.100.0, <=0.123.0) +18 more potentially affected by CVE-2024-23644 via trillium-http (>=0.2.14, <=0.3.3)

trillium-http CARGO version =0.2.14, =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.1.0, =0.2.0, =0.0.1, =0.2.0, =0.2.0, =0.3.0, =0.3.1 and more Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...