Fedora 40 : retsnoop / rust-rbspy (2024-ccce2763b0)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ccce2763b0 advisory. Rebuild affected applications with ruzstd v0.7.3 to address RUSTSEC-2024-0400. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 40 : rust-rustls (2024-5a5f401785)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5a5f401785 advisory. Update to version 0.23.19. This version includes fix for RUSTSEC-2024-0399. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 41 : rust-rustls (2024-0d14d0d2f9)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0d14d0d2f9 advisory. Update to version 0.23.19. This version includes fix for RUSTSEC-2024-0399. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 41 : retsnoop / rust-rbspy (2024-aa246ab1a3)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-aa246ab1a3 advisory. Rebuild affected applications with ruzstd v0.7.3 to address RUSTSEC-2024-0400. Tenable has extracted the preceding description block directly from the Fedora...

boltchat (>=0.2.0, <=0.2.2), cargo-generate-rpm (>=0.10.0, <=0.11.0) +17 more potentially affected by CVE-2024-53856 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.10.0, =0.8.0, =0.2.0, =0.1.0, =0.1.0, =0.19.0, =0.9.0-alpha.1, =0.0.1, =0.7.0, =0.8.1 - rpm-rs-temporary 0.6.1 - rpmrepometadata 0.2.0 and more Source cves: CVE-2024-53856 Source advisory: OSV:RUSTSEC-2024-0447...

dbs-arch (>=0.2.2, <=0.2.3), dbs-boot (>=0.3.0, <=0.4.0) +7 more potentially affected by unknown CVE via kvm-ioctls (>=0.6.1, <=0.18.0)

kvm-ioctls CARGO version =0.6.1, =0.2.2, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.29, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0428...

flate2 (>=1.0.29, <=1.0.34), libz-rs-sys (>=0.0.1, <=0.3.1) +1 more potentially affected by unknown CVE via zlib-rs (>=0.0.1, <=0.3.1)

zlib-rs CARGO version =0.0.1, =1.0.29, =0.0.1, =0.3.0, =0.3.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0401...

RUSTSEC-2024-0438 Wasmtime doesn't fully sandbox all the Windows device filenames

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-2hh8. For more information see the GitHub-hosted security advisory...

arci-urdf-viz (>=0.0.7, <=0.1.0), asp_lib (>=0.1.0, <=0.1.1) +96 more potentially affected by unknown CVE via fast-float (0.2.0)

fast-float CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fast-float and may be impacted: - arci-urdf-viz =0.0.7, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.13.0, =0.19.0, =0.3.0, =0.4.1, =0.6.2, =0.3.2, =0.4.1, =0.3.2, =0.20.2 and more...

b4ae (>=2.0.0, <=2.1.3), crypt_guard (>=0.1.4, <=1.3.6) +25 more potentially affected by unknown CVE via pqcrypto-dilithium (>=0.1.1, <=0.5.0)

pqcrypto-dilithium CARGO version =0.1.1, =2.0.0, =0.1.4, =0.1.1, =0.1.0, =0.1.1, =0.0.1, =0.6.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.5.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0380...

b4ae (>=2.0.0, <=2.1.3), clatter (>=0.1.2-alpha, <=2.0.0-rc.1) +28 more potentially affected by unknown CVE via pqcrypto-kyber (>=0.1.2, <=0.8.1)

pqcrypto-kyber CARGO version =0.1.2, =2.0.0, =0.1.2-alpha, =0.1.4, =0.1.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0 - qudag-exchange 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0381...

Fedora 40 : rust-pyo3 / rust-pyo3-build-config / rust-pyo3-ffi / etc (2024-23292e9f6d)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-23292e9f6d advisory. Update pyo3 to version 0.22.4. This version addresses a potential use-after-free RUSTSEC-2024-0378. Tenable has extracted the preceding description block...

aa2nucaln (0.1.1), aamp (>=0.1.0, <=0.1.6) +9428 more potentially affected by unknown CVE via paste (>=0.1.18, <=1.0.15)

paste CARGO version =0.1.18, =0.1.0, =0.1.0, =0.1.0, =0.11.2, =0.1.0, =0.1.0, =0.1.1, =0.10.3, =0.9.0, =0.2.0-beta.4, =0.15.1, =0.19.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0436...

RUSTSEC-2024-0439 Race condition could lead to WebAssembly control-flow integrity and type safety violations

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7qmx-3fpx-r45m. For more information see the GitHub-hosted security advisory...

RUSTSEC-2024-0440 Runtime crash when combining tail calls with stack traces

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg. For more information see the GitHub-hosted security advisory...

lexical-core has multiple soundness issues

RUSTSEC-2024-0377 contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls...

afarray (>=0.1.0, <=0.15.1), b-table (>=0.1.0, <=0.2.1) +39 more potentially affected by unknown CVE via get-size-derive (>=0.1.2, <=0.1.3)

get-size-derive CARGO version =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.8.0, =0.1.0, =0.1.0, =0.3.1, =0.9.1, =0.0.6, =0.1.0, =0.8.0, =0.9.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0427...

Fedora: Security Advisory (FEDORA-2023-d88521bfc5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-12f0caa904)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-638f25a317)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...