Use after free in libflate

An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution...

alloc-cortex-m (>=0.3.0, <=0.3.2), alloc-fmt (>=0.1.0, <=0.2.0) +66 more potentially affected by CVE-2019-16137 via spin (>=0.3.5, <=0.4.10)

spin CARGO version =0.3.5, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.2, =0.1.3, =0.0.1, =0.2.0, =0.2.1, =0.1.0, =0.1.1, =0.3.0, =0.4.0 and more Source cves: CVE-2019-16137 Source advisory: GHSA-HV7X-F3PV-GPWR...

alloc-cortex-m (>=0.3.0, <=0.3.2), alloc-fmt (>=0.1.0, <=0.2.0) +66 more potentially affected by CVE-2019-16137 via spin (>=0.3.5, <=0.4.10)

spin CARGO version =0.3.5, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.2, =0.1.3, =0.0.1, =0.2.0, =0.2.1, =0.1.0, =0.1.1, =0.3.0, =0.4.0 and more Source cves: CVE-2019-16137 Source advisory: OSV:GHSA-HV7X-F3PV-GPWR...

akaze (>=0.1.0, <=0.1.2), alass-cli (>=1.0.0, <=2.0.0) +285 more potentially affected by CVE-2019-16138 via image (>=0.10.4, <=0.20.1)

image CARGO version =0.10.4, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.4, =0.1.0, =0.1.0, =0.2.0, =0.4.1 and more Source cves: CVE-2019-16138 Source advisory: OSV:GHSA-M2PF-HPRP-3VQM...

GHSA-4X25-PVHW-5224 Algorithms compute incorrect results in blake2

An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes...

Out of bounds write in slice-deque

Affected versions of this crate entered a corrupted state if mem::sizeof:: % allocationgranularity != 0 and a specific allocation pattern was used: sufficiently shifting the deque elements over the mirrored page boundary. This allows an attacker that controls controls both element insertion and...

buf-ref-reader (0.3.0), buf_redux (>=0.7.0, <=0.8.1) +8 more potentially affected by CVE-2019-15543 via slice-deque (0.1.16)

slice-deque CARGO version 0.1.16 is affected by a known vulnerability. The following packages have a transitive dependency on slice-deque and may be impacted: - buf-ref-reader 0.3.0 - bufredux =0.7.0, =0.1.0, =0.2.0, =0.1.0, =0.12.0, =0.14.0 - reactive-rs 0.1.1 - rtplot 0.2.0 - seqio 0.3.0 Source...

GHSA-C3M3-C39Q-PV23 Out of bounds write in slice-deque

Affected versions of this crate entered a corrupted state if mem::sizeof:: % allocationgranularity != 0 and a specific allocation pattern was used: sufficiently shifting the deque elements over the mirrored page boundary. This allows an attacker that controls controls both element insertion and...

azure-functions (>=0.1.1, <=0.2.1), ekiden-grpcio (>=0.3.0, <=0.3.2) +15 more potentially affected by CVE-2019-15544 via protobuf (>=2.0.2, <=2.5.0)

protobuf CARGO version =2.0.2, =0.1.1, =0.3.0, =0.4.0, =0.3.0, =0.3.0, =0.3.0, =2.0.2, =2.0.2, =0.2.0, =2.0.2, =0.3.0, =0.1.0, =0.1.1 and more Source cves: CVE-2019-15544 Source advisory: OSV:GHSA-MH6H-F25P-98F8...

Uncontrolled recursion in ammonia

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization...

GHSA-5HP8-35WJ-M525 Uncontrolled recursion in ammonia

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization...

aerospike (0.3.0), ag (>=0.7.5, <=0.7.6) +223 more potentially affected by CVE-2019-15553 via memoffset (>=0.1.0, <=0.2.1)

memoffset CARGO version =0.1.0, =0.7.5, =0.2.5, =0.4.0, =0.6.0, =0.5.0, =0.4.0, =0.5.0, =0.6.0, =0.7.0, =0.3.0, =0.3.0, =0.1.0, =0.6.0, =0.7.0 and more Source cves: CVE-2019-15553 Source advisory: OSV:GHSA-RH89-X75F-RH3C...

audrey (0.1.0) potentially affected by CVE-2018-20992 via claxon (0.2.1)

claxon CARGO version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on claxon and may be impacted: - audrey 0.1.0 Source cves: CVE-2018-20992 Source advisory: OSV:GHSA-8C6G-4XC5-W96C...

Potential memory corruption in arrayfire

The attribute repr added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain. arrayfire crates = version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28. The issue seems to be interlink...

GHSA-69FV-GW6G-8CCG Potential memory corruption in arrayfire

The attribute repr added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain. arrayfire crates = version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28. The issue seems to be interlink...

nifti (>=0.3.1, <=0.6.0), trk-io (>=0.3.0, <=0.11.0) potentially affected by CVE-2018-21000 via safe-transmute (>=0.5.0, <=0.8.0)

safe-transmute CARGO version =0.5.0, =0.3.1, =0.3.0, =0.11.0 Source cves: CVE-2018-21000 Source advisory: OSV:GHSA-2V78-J59H-FMPF...

Uncontrolled recursion in rust-yaml

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth...

aa2 (>=0.9.0, <=0.9.1), abridge (>=1.0.0, <=1.1.6) +337 more potentially affected by CVE-2018-20993 via yaml-rust (>=0.2.2, <=0.3.5)

yaml-rust CARGO version =0.2.2, =0.9.0, =1.0.0, =0.0.1, =0.1.0, =0.3.0, =0.2.0, =0.1.0, =0.0.0, =0.0.2, =0.0.1, =0.9.0, =0.1.0, =0.2.0, =0.4.1 and more Source cves: CVE-2018-20993 Source advisory: GHSA-HV87-47H9-JCVQ...

GHSA-HV87-47H9-JCVQ Uncontrolled recursion in rust-yaml

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth...

aa2 (>=0.9.0, <=0.9.1), abridge (>=1.0.0, <=1.1.6) +337 more potentially affected by CVE-2018-20993 via yaml-rust (>=0.2.2, <=0.3.5)

yaml-rust CARGO version =0.2.2, =0.9.0, =1.0.0, =0.0.1, =0.1.0, =0.3.0, =0.2.0, =0.1.0, =0.0.0, =0.0.2, =0.0.1, =0.9.0, =0.1.0, =0.2.0, =0.4.1 and more Source cves: CVE-2018-20993 Source advisory: OSV:GHSA-HV87-47H9-JCVQ...