h2o -- uninitialised memory access in HTTP3

Emil Lerner reports: When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state ...

PT-2021-18731

Name of the Vulnerable Software and Affected Versions outer cgi crate versions prior to 0.2.1 Description An issue in the outer cgi crate allows a user-provided Read instance to receive an uninitialized memory buffer from KeyValueReader. This can cause the Read instance to read uninitialized...

PT-2021-17194

Name of the Vulnerable Software and Affected Versions: postscript crate versions prior to 0.14.0 Description: The issue allows attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation. Affected versions of the crate pass an uninitialize...

Rust Memory Corruption Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Rust has a memory corruption vulnerability in versions prior to 0.2.3. The vulnerability stems from the program's implied randomness to arrays, so that uninitialized memory may be discarded in the event of an...

CentOS 8 : GNOME (CESA-2019:3553)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3553 advisory. - webkitgtk: HTTP proxy setting deanonymization information disclosure CVE-2019-11070 - evince: uninitialized memory use in function tiffdocumentrender...

CVE-2021-25905

An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory...

CVE-2021-25905

An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory...

Design/Logic Flaw

An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory...

CVE-2020-36210

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption...

CVE-2020-36210

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption...

Memory corruption

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption...

Deserialization functions pass uninitialized memory to user-provided Read

Affected versions of this crate passed an uninitialized buffer to a user-provided Read instance in: deserializebinary deserializestring deserializeextensionothers deserializestringprimitive This can result in safe Read implementations reading from the uninitialized buffer leading to undefined...

RUSTSEC-2021-0092 Deserialization functions pass uninitialized memory to user-provided Read

Affected versions of this crate passed an uninitialized buffer to a user-provided Read instance in: deserializebinary deserializestring deserializeextensionothers deserializestringprimitive This can result in safe Read implementations reading from the uninitialized buffer leading to undefined...

RUSTSEC-2021-0016 `IoReader::read()`: user-provided `Read` on uninitialized buffer may cause UB

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. Arbitrary Read implementations can read from the uninitialized buffer memory exposure and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory...

PT-2021-24266

Name of the Vulnerable Software and Affected Versions: messagepack-rs crate through 2021-01-26 Description: The issue in the messagepack-rs crate allows functions such as deserialize binary, deserialize string, deserialize extension others, and deserialize string primitive to read from...

PT-2021-24265

Name of the Vulnerable Software and Affected Versions: messagepack-rs crate through 2021-01-26 Description: An issue was discovered in the messagepack-rs crate where certain functions may read from uninitialized memory locations, leading to undefined behavior. The affected functions include...

PT-2021-24267

Name of the Vulnerable Software and Affected Versions: messagepack-rs crate through 2021-01-26 Description: The issue in the messagepack-rs crate allows functions such as deserialize binary, deserialize string, deserialize extension others, and deserialize string primitive to read from...

PT-2021-16995

Name of the Vulnerable Software and Affected Versions marc crate versions prior to 2.0.0 Description An issue was discovered in the marc crate for Rust, where a user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness. The affected...

PT-2021-17193

Name of the Vulnerable Software and Affected Versions: ms3d crate versions prior to 0.1.3 Description: The issue allows attackers to obtain sensitive information from uninitialized memory locations via IoReader::read. Affected versions of the crate pass an uninitialized buffer to a user-provided...

Rust buffer error vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability existed in Rust prior to version 0.1.1. The vulnerability stems from a lack of program soundness and may read uninitialized memory. No details of the vulnerability are provided at this...