RUSTSEC-2025-0170 `hugepage_rs::dealloc` may allow invalid memory deallocation from safe code

hugepagers::dealloc was a publicly accessible safe function. It accepted an arbitrary raw pointer and Layout, then forwarded them to the hugepage allocator's GlobalAlloc::dealloc implementation. GlobalAlloc::dealloc requires callers to ensure that the pointer denotes a block of memory currently...

aabb_physics (>=0.1.0, <=0.1.1), acolor (>=0.0.2, <=0.0.11) +117 more potentially affected by unknown CVE via macroquad (>=0.2.9, <=0.4.16)

macroquad CARGO version =0.2.9, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0035...

RUSTSEC-2025-0032 Safe API can cause heap-buffer-overflow

ffi::nstr should be marked unsafe, since a pointer to a buffer without a trailing 0 value will cause a heap buffer overflow...

addr2line (>=0.1.0, <=0.3.0), ai4ose-tg-rcore-tutorial-ch8-doom (0.1.0-preview.1) +139 more potentially affected by unknown CVE via xmas-elf (>=0.3.0, <=0.9.1)

xmas-elf CARGO version =0.3.0, =0.1.0, =0.1.4, =0.1.0, =0.1.0, =0.1.1, =0.11.0-beta, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0018...

aati (>=0.10.2, <=0.11.3), acme-clusters (>=0.2.2, <=0.2.3) +1352 more potentially affected by unknown CVE via ring (>=0.13.5, <=0.16.20)

ring CARGO version =0.13.5, =0.10.2, =0.2.2, =0.2.2, =0.1.0, =0.3.5, =0.3.0, =1.0.0, =0.1.0, =1.0.0, =0.1.12, =0.1.14, =0.1.12, =0.1.13, =0.4.0, =0.4.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0010...

cueball (>=0.3.0, <=0.3.5), cueball-static-resolver (>=0.3.0, <=0.3.1) +14 more potentially affected by unknown CVE via backoff (>=0.1.6, <=0.4.0)

backoff CARGO version =0.1.6, =0.3.0, =0.3.0, =0.3.0, =0.0.0, =0.3.0, =0.4.0, =0.4.0, =0.6.0, =4.1.0, =0.3.5, =0.1.0, =0.25.0, =0.14.0, =1.0.0, =1.0.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0012...

cymrust (>=0.3.0, <=0.3.4), honeypot_blacklist (0.1.0) +4 more potentially affected by unknown CVE via resolve (>=0.1.2, <=0.2.0)

resolve CARGO version =0.1.2, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0013...

datafu (>=0.0.6, <=0.0.7) potentially affected by unknown CVE via totally-safe-transmute (0.0.3)

totally-safe-transmute CARGO version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on totally-safe-transmute and may be impacted: - datafu =0.0.6, =0.0.7 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0030...

Fedora 41 : clevis-pin-tpm2 / dbus-parsec / envision / fido-device-onboard / etc (2025-f8be7978e3)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-f8be7978e3 advisory. Update the openssl crate to version 0.10.70 and the openssl-sys crate to version 0.9.105. This includes a fix for RUSTSEC-2025-0004 / CVE-2025-0977 and...

acct (>=0.2.0, <=0.5.0), almel (>=1.0.0, <=1.4.7) +179 more potentially affected by CVE-2025-5791 via users (>=0.8.1, <=0.11.0)

users CARGO version =0.8.1, =0.2.0, =1.0.0, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.9.0, =0.2.4, =0.1.0, =0.4.2, =0.4.0, =0.7.4, =0.1.4, =0.8.2, =0.8.3 and more Source cves: CVE-2025-5791 Source advisory: OSV:RUSTSEC-2025-0040...

eventlog (>=0.1.0, <=0.3.1), fltevtlog (0.1.0) +7 more potentially affected by unknown CVE via registry (1.3.0)

registry CARGO version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on registry and may be impacted: - eventlog =0.1.0, =0.1.0, =0.9.0, =0.1.0+winfsp-1.11, =0.0.0, =0.2.0, =0.2.0, =0.4.1 Source cves: unknown CVE Source advisory:...

avery (>=0.1.0, <=0.7.1), bibjoin (>=0.1.2, <=0.2.1) +64 more potentially affected by unknown CVE via fast-float (0.2.0)

fast-float CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fast-float and may be impacted: - avery =0.1.0, =0.1.2, =0.1.0, =0.13.0, =0.19.0, =0.4.1, =0.6.2, =0.3.2, =0.4.1, =0.3.2, =0.3.2, =0.1.0, =1.0.8, =1.1.0 and more Source cves...

clipass (0.1.0), clipperd (>=0.1.1, <=0.1.5) +9 more potentially affected by unknown CVE via magic-crypt (3.1.13)

magic-crypt CARGO version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on magic-crypt and may be impacted: - clipass 0.1.0 - clipperd =0.1.1, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.4 Source cves: unknown CVE Source advisory...

xous-ipc (0.8.0) potentially affected by unknown CVE via xous (0.8.3)

xous CARGO version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on xous and may be impacted: - xous-ipc 0.8.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0431...

Fedora: Security Advisory (FEDORA-2024-ccce2763b0)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : rust-rustls (2024-0d14d0d2f9)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0d14d0d2f9 advisory. Update to version 0.23.19. This version includes fix for RUSTSEC-2024-0399. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 40 : rust-rustls (2024-5a5f401785)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5a5f401785 advisory. Update to version 0.23.19. This version includes fix for RUSTSEC-2024-0399. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 40 : retsnoop / rust-rbspy (2024-ccce2763b0)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ccce2763b0 advisory. Rebuild affected applications with ruzstd v0.7.3 to address RUSTSEC-2024-0400. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 41 : retsnoop / rust-rbspy (2024-aa246ab1a3)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-aa246ab1a3 advisory. Rebuild affected applications with ruzstd v0.7.3 to address RUSTSEC-2024-0400. Tenable has extracted the preceding description block directly from the Fedora...

boltchat (>=0.2.0, <=0.2.2), kanga-rpm-rs (0.7.0) +5 more potentially affected by CVE-2024-53856 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.1.0, =0.3.0, =0.3.2 Source cves: CVE-2024-53856 Source advisory: OSV:RUSTSEC-2024-0447...