Uninitialized memory exposure in any_as_u8_slice

The safe function anyasu8slice can create byte slices that reference uninitialized memory when used with types containing padding bytes. The function uses slice::fromrawparts to create a &u8 covering the entire size of a type, including padding bytes. According to Rust's documentation, fromrawpar...

RUSTSEC-2025-0106 Undefined behavior in index_of_ptr with empty slices

The safe function indexofptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...

PT-2025-46132

The safe function any as u8 slice can create byte slices that reference uninitialized memory when used with types containing padding bytes. The function uses slice::from raw parts to create a &u8 covering the entire size of a type, including padding bytes. According to Rust's documentation, from...

PT-2025-46130

The safe function create ring buffer allocates a buffer using Vec::with capacity followed by set len, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like write slices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust...

PT-2025-45714

The safe function create ring buffer allocates a buffer using Vec::with capacity followed by set len, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like write slices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust...

PT-2025-45729

The safe function index of ptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...

PT-2025-46131

The safe function index of ptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...

CVE-2025-55085

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior...

CVE-2025-55085

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior...

CVE-2025-55085 Web http client: Unchecked Server-Side Malicious Packet Issue

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior...

CVE-2025-55085

In NextX Duo prior to 6.4.4, the HTTP client module’s handling of HTTP header fields in the Eclipse Foundation ThreadX network support code lacks bounds verification. This can be triggered by a crafted server response and leads to undefined behavior. Affected product/version: NextX Duo

EUVD-2025-34883

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior...

CVE-2025-55085 Web http client: Unchecked Server-Side Malicious Packet Issue

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior...

PT-2025-42611

Name of the Vulnerable Software and Affected Versions NextX Duo versions prior to 6.4.4 Description The HTTP client module in NextX Duo does not properly validate the boundaries when parsing HTTP header fields. This missing bounds verification could lead to undefined behavior if a server sends a...

bloaty:fuzz_target: Crash in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/google/bloaty.git Detailed Report: https://oss-fuzz.com/testcase?key=5090236586852352 Project: bloaty Fuzzing Engine: libFuzzer Fuzz Target: fuzztarget Job Type: libfuzzerubsanbloaty Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5b19eed80051 Crash State:...

SUSE CVE-2022-50511

In the Linux kernel, the following vulnerability has been resolved: lib/fonts: fix undefined behavior in bit shift for getdefaultfont Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds i...

Linux Distros Unpatched Vulnerability : CVE-2022-50478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nilfs2: fix shift-out-of-bounds/overflow in nilfssb2badoffset Patch series nilfs2: fix UBSAN shift- out-of-bounds warnings on mount time. The first patch fixes ...

Linux Distros Unpatched Vulnerability : CVE-2021-4460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of- bounds warning If getnumsdmaqueues or getnumxgmisdmaqueu...

Linux Distros Unpatched Vulnerability : CVE-2023-53485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in...

CVE-2022-50511

In the Linux kernel, the following vulnerability has been resolved: lib/fonts: fix undefined behavior in bit shift for getdefaultfont Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds i...