RUSTSEC-2020-0034 Multiple security issues including data race, buffer overflow, and uninitialized memory drop

arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...

Matrix::new() drops uninitialized memory

Matrix::new internally calls Matrix::fillwith which uses ptr = value pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of uninitialized struct...

Multiple security issues including data race, buffer overflow, and uninitialized memory drop

arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...

PT-2020-17519

Name of the Vulnerable Software and Affected Versions arr crate versions through 2020-08-25 Description The issue concerns a buffer overflow in Index and IndexMut implementations. Additionally, there are problems with the implementation of Sync/Send bounds, allowing non-Sync/Send types to be...

PT-2020-17520

Name of the Vulnerable Software and Affected Versions arr crate through 2020-08-25 Description The issue concerns the arr crate, which contains multiple security issues. These include incorrect implementation of Sync/Send bounds, allowing non-Sync/Send types to be smuggled across thread boundarie...

PT-2020-17518

Name of the Vulnerable Software and Affected Versions arr crate versions through 2020-08-25 Description The issue allows an attacker to smuggle non-Sync/Send types across a thread boundary, causing a data race. Specifically, the arr crate incorrectly implements Sync/Send bounds. Additionally, the...

PT-2020-17611

Name of the Vulnerable Software and Affected Versions alg ds crate through 2020-08-25 Description The issue is related to a drop of uninitialized memory in Matrix::new. This function internally calls Matrix::fill with, which uses the ptr = value pattern to initialize the buffer. This pattern...

Node.js third-party modules: [bl] Uninitialized memory exposure via negative .consume()

Module module name: bl version: 4.0.2 npm page: https://www.npmjs.com/package/bl Module Description A Node.js Buffer list collector, reader and streamer thingy. Module Stats 8 660 595 weekly downloads Vulnerability Vulnerability Description If user input even typed ends up in consume argument and...

PT-2020-4972

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.8.4 Description An issue was discovered in the romfs dev read function in fs/romfs/storage.c that is related to insufficient input validation, allowing an attacker to gain unauthorized access to protected...

MGASA-2020-0335 Updated x11-server packages fix security vulnerability

Allocation for pixmap data in AllocatePixmap does not initialize the memory in xserver, it leads to leak uninitialize heap memory to clients. When the X server runs with elevated privileges. This flaw can lead to ASLR bypass, which when combined with other flaws known/unknown could lead to lead t...

PT-2020-4126

Name of the Vulnerable Software and Affected Versions: Intel Server Board S2600CW Family versions affected versions not specified Intel Server Board S2600KP Family versions affected versions not specified Intel Server Board S2600TP Family versions affected versions not specified Intel Server Boar...

Information Disclosure

php7 is vulnerable to information disclosure. The vulnerability exists while parsing EXIF data with exifreaddata function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory...

UBUNTU-CVE-2020-14347

A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable...

FreeBSD : xorg-server -- Pixel Data Uninitialized Memory Information Disclosure (3c7ba82a-d3fb-11ea-9aba-0c9d925bbbc0)

The X.org project reports : Allocation for pixmap data in AllocatePixmap does not initialize the memory in xserver, it leads to leak uninitialize heap memory to clients. When the X server runs with elevated privileges. This flaw can lead to ASLR bypass, which when combined with other flaws...

Updated matio packages fix security vulnerability

MatVarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdupvprintf when uninitialized memory is accessed. CVE-2019-17533...

PT-2020-3582 · Xorg +8 · Xorg-Server +8

Name of the Vulnerable Software and Affected Versions: Xorg-server versions prior to 1.20.9 Description: A flaw was found in the way xserver memory was not properly initialized, which could leak parts of server memory to the X client. In cases where the Xorg server runs with elevated privileges,...

Huawei EulerOS: Security Advisory for libexif (EulerOS-SA-2020-1809)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : libvncserver (EulerOS-SA-2020-1811)

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.CVE-2020-14403 - An...

EulerOS 2.0 SP8 : libexif (EulerOS-SA-2020-1809)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and...

openSUSE Security Update : LibVNCServer (openSUSE-2020-1025)

This update for LibVNCServer fixes the following issues : - security update - added patches fix CVE-2018-21247 bsc1173874, uninitialized memory contents are vulnerable to Information leak + LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839 bsc1173875, buffer overflow in ConnectClientToUnixSock...