CVE-2022-36114 Extracting malicious crates can fill the file system

Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size also known as a...

CVE-2022-36113: Improper Limitation of a Pathname to a Restricted Directory

Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the...

alloc-cortex-m (>=0.1.0, <=0.4.2), bottleos (0.2.0) +23 more potentially affected by CVE-2022-36086 via linked_list_allocator (>=0.2.7, <=0.9.1)

linkedlistallocator CARGO version =0.2.7, =0.1.0, =0.1.0, =0.3.0, =0.4.0-pre, =0.4.0-pre, =0.1.0, =0.0.1, =0.3.2, =0.11.0, =0.1.0, =0.0.1, =0.1.0 and more Source cves: CVE-2022-36086 Source advisory: OSV:RUSTSEC-2022-0063...

GHSA-C439-CHV8-8G2J `os_socketaddr` invalidly assumes the memory layout of std::net::SocketAddr

The ossocketaddr crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. These layout were changed into idiomatic rust...

RUSTSEC-2022-0052 `os_socketaddr` invalidly assumes the memory layout of std::net::SocketAddr

The ossocketaddr crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. These layout were changed into idiomatic rust...

OPCUA security vulnerabilities

opcua is a client and server implementation of the OPC UA specification written in Rust. A security vulnerability exists in opcua that stems from the lack of a limit on the number of received blocks total number per session or across all concurrent sessions...

Denial of Service (DoS)

Overview opcua is an OPC UA server / client API implementation for Rust. Affected versions of this package are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit thi...

Rust std::fs::remove_dir_all Use-After-Free

The vulnerability of the std::fs::removedirall function in the Rust programming language is related to synchronization errors when using a shared resource. Exploiting this vulnerability could allow an attacker to delete arbitrary system files and directories...

Ropr - A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative

ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP Return Oriented Programming Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which already exist as executable code within each binary or library. These gadgets may be...

Exploit for Improper Privilege Management in Wfs Heaven_Burns_Red

EvilWfshbr CVE-2022-42046https://vulners.com/cve/CVE-2022-...

Fedora: Security Advisory for rust-ffsend (FEDORA-2022-dfa24fa7d4)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-ffsend (FEDORA-2022-163bcf190f)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: rust-ffsend-0.2.71-3.fc35

Easily and securely share files from the command line. A fully featured Firef ox Send client...

[SECURITY] Fedora 36 Update: rust-ffsend-0.2.76-2.fc36

Easily and securely share files from the command line. A fully featured Send client...

Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...

Apache Avro Denial of Service Vulnerability

Apache Avro is a data serialization system from the Apache Foundation, Inc. A denial of service vulnerability exists in versions of Apache Avro Rust prior to 0.14.0, which stems from an integer overflow when reading corrupted .avro files in the Avro Rust SDK, and can be exploited by an attacker t...

GHSA-9QXH-258V-666C owning_ref vulnerable to multiple soundness issues

OwningRef::mapwithowner is unsound and may result in a use-after-free. - OwningRef::map is unsound and may result in a use-after-free. - OwningRefMut::asowner and OwningRefMut::asownermut are unsound and may result in a use-after-free. - The crate violates Rust's aliasing rules, which may cause...

Apache Avro Rust SDK corrupted data read can cause crash

It is possible to crash panic an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 previously known as avro-rs. Users should update to apache-avro version 0.14.0 which addresses this issue...

GHSA-V456-CHPW-6MMW Apache Avro Rust SDK vulnerable to reader looping in cycle endlessly, consuming CPU

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 previously known as avro-rs. Users should update to apache-avro version 0.14.0 which addresses this issue...

GHSA-WCM8-86X6-8MV3 Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 previously known as avro-rs. Users should update to apache-avro version 0.14.0 which addresses...