GHSA-R7RV-2RPH-HVHJ Improper synchronization in buttplug

An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider !Send|!Sync objects, leading to a data race...

Improper synchronization in buttplug

An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider !Send|!Sync objects, leading to a data race...

GHSA-8GF5-Q9P9-WVMC Data race in atomic-option

An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption implements Sync unconditionally, a data race can occur...

Data race in atomic-option

An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption implements Sync unconditionally, a data race can occur...

acheron (0.1.0), crudite (0.1.0) +22 more potentially affected by CVE-2020-36204 via im (>=12.3.4, <=15.0.0)

im CARGO version =12.3.4, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0-alpha.1, =0.4.0-alpha.2 - moniker 0.5.0 - piecs 0.1.0 - piecsderiveold 0.1.0 and more Source cves: CVE-2020-36204 Source advisory: OSV:GHSA-Q9H2-4XHF-23XX...

Data races in im

An issue was discovered in the im crate prior to 15.1.0 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur...

GHSA-C8HQ-X4MM-P6Q6 Memory handling issues in xcb

An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur...

Memory handling issues in xcb

An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur...

aoa (0.1.0), blinkrs (1.0.1) +30 more potentially affected by CVE-2020-36206 via rusb (>=0.4.0, <=0.6.5)

rusb CARGO version =0.4.0, =0.2.0, =0.6.0, =0.2.0, =0.1.0, =1.0.0-alpha.2, =0.1.0, =0.1.0, =1.0.0, =0.4.0, =0.5.0, =0.1.0, =0.1.5 and more Source cves: CVE-2020-36206 Source advisory: OSV:GHSA-9MXW-4856-9CM5...

ahrightos-kernel (0.1.0), bootloader (>=0.10.0-alpha-01, <=0.10.13) +2 more potentially affected by CVE-2020-36208 via conquer-once (0.2.1)

conquer-once CARGO version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on conquer-once and may be impacted: - ahrightos-kernel 0.1.0 - bootloader =0.10.0-alpha-01, =0.14.0, =0.1.0, =0.2.6 Source cves: CVE-2020-36208 Source advisory:...

Data races in aovec

An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur...

GHSA-G489-XRW3-3V8W Data races in aovec

An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur...

efw (0.1.0) potentially affected by CVE-2020-36209 via late-static (0.3.0)

late-static CARGO version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on late-static and may be impacted: - efw 0.1.0 Source cves: CVE-2020-36209 Source advisory: OSV:GHSA-WR55-MF5C-HHWM...

Free of uninitialized memory in autorand

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption...

curl (>=0.4.7, <=0.4.8), dns-lookup (>=0.7.0, <=0.8.1) +4 more potentially affected by CVE-2020-35919 +1 more via socket2 (0.2.4)

socket2 CARGO version 0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on socket2 and may be impacted: - curl =0.4.7, =0.7.0, =0.1.0, =0.1.5 - libmdns 0.2.2 - miow 0.3.0 Source cves: CVE-2020-35919, CVE-2020-35920 Source advisory:...

adi (>=0.4.0, <=0.6.0), adi_screen (>=0.3.0, <=0.7.0) +114 more potentially affected by CVE-2020-35923 via ordered-float (>=0.2.3, <=1.0.2)

ordered-float CARGO version =0.2.3, =0.4.0, =0.3.0, =0.7.5, =0.2.0, =3.1.3, =0.1.1, =0.9.0, =0.0.10, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.20 and more Source cves: CVE-2020-35923 Source advisory: OSV:GHSA-566X-HHRF-QF8M...

GHSA-J42V-6WPM-R847 Data races in thex

An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex allows cross-thread data races of non-Send types...

Data races in thex

An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex allows cross-thread data races of non-Send types...

async-metronome (0.2.0), bach (>=0.0.1, <=0.0.2) +8 more potentially affected by CVE-2020-35926 via nanorand (0.4.4)

nanorand CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on nanorand and may be impacted: - async-metronome 0.2.0 - bach =0.0.1, =0.1.0, =0.1.0, =0.4.7, =0.1.0, =0.1.1 Source cves: CVE-2020-35926 Source advisory: OSV:GHSA-M9M5-CG5H-R58...

async-metronome (0.2.0), bach (>=0.0.1, <=0.0.2) +8 more potentially affected by CVE-2020-35926 via nanorand (0.4.4)

nanorand CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on nanorand and may be impacted: - async-metronome 0.2.0 - bach =0.0.1, =0.1.0, =0.1.0, =0.4.7, =0.1.0, =0.1.1 Source cves: CVE-2020-35926 Source advisory: GHSA-M9M5-CG5H-R582...