CVE-2020-25016: Improper Restriction of Operations within the Bounds of a Memory Buffer

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to for example dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations...

Denial Of Service (DoS)

bl is vulnerable to denial of service. An uninitialized memory access via negative .consume allows an attacker to crash the application and potentially obtain confidential information that is stored in memory...

EulerOS 2.0 SP8 : unbound (EulerOS-SA-2020-1886)

According to the version of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP...

Amazon Linux 2 : evince (ALAS-2020-1474)

The version of evince installed on the remote host is prior to 3.28.2-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1474 advisory. The tiffdocumentrender and tiffdocumentgetthumbnail functions in the TIFF document backend in GNOME Evince through 3.32.0 did not...

RUSTSEC-2020-0034 Multiple security issues including data race, buffer overflow, and uninitialized memory drop

arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...

Matrix::new() drops uninitialized memory

Matrix::new internally calls Matrix::fillwith which uses ptr = value pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of uninitialized struct...

Multiple security issues including data race, buffer overflow, and uninitialized memory drop

arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...

PT-2020-17519

Name of the Vulnerable Software and Affected Versions arr crate versions through 2020-08-25 Description The issue concerns a buffer overflow in Index and IndexMut implementations. Additionally, there are problems with the implementation of Sync/Send bounds, allowing non-Sync/Send types to be...

PT-2020-17520

Name of the Vulnerable Software and Affected Versions arr crate through 2020-08-25 Description The issue concerns the arr crate, which contains multiple security issues. These include incorrect implementation of Sync/Send bounds, allowing non-Sync/Send types to be smuggled across thread boundarie...

PT-2020-17518

Name of the Vulnerable Software and Affected Versions arr crate versions through 2020-08-25 Description The issue allows an attacker to smuggle non-Sync/Send types across a thread boundary, causing a data race. Specifically, the arr crate incorrectly implements Sync/Send bounds. Additionally, the...

PT-2020-17611

Name of the Vulnerable Software and Affected Versions alg ds crate through 2020-08-25 Description The issue is related to a drop of uninitialized memory in Matrix::new. This function internally calls Matrix::fill with, which uses the ptr = value pattern to initialize the buffer. This pattern...

Node.js third-party modules: [bl] Uninitialized memory exposure via negative .consume()

Module module name: bl version: 4.0.2 npm page: https://www.npmjs.com/package/bl Module Description A Node.js Buffer list collector, reader and streamer thingy. Module Stats 8 660 595 weekly downloads Vulnerability Vulnerability Description If user input even typed ends up in consume argument and...

PT-2020-4972

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.8.4 Description An issue was discovered in the romfs dev read function in fs/romfs/storage.c that is related to insufficient input validation, allowing an attacker to gain unauthorized access to protected...

MGASA-2020-0335 Updated x11-server packages fix security vulnerability

Allocation for pixmap data in AllocatePixmap does not initialize the memory in xserver, it leads to leak uninitialize heap memory to clients. When the X server runs with elevated privileges. This flaw can lead to ASLR bypass, which when combined with other flaws known/unknown could lead to lead t...

PT-2020-4126

Name of the Vulnerable Software and Affected Versions: Intel Server Board S2600CW Family versions affected versions not specified Intel Server Board S2600KP Family versions affected versions not specified Intel Server Board S2600TP Family versions affected versions not specified Intel Server Boar...

Information Disclosure

php7 is vulnerable to information disclosure. The vulnerability exists while parsing EXIF data with exifreaddata function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory...

UBUNTU-CVE-2020-14347

A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable...

FreeBSD : xorg-server -- Pixel Data Uninitialized Memory Information Disclosure (3c7ba82a-d3fb-11ea-9aba-0c9d925bbbc0)

The X.org project reports : Allocation for pixmap data in AllocatePixmap does not initialize the memory in xserver, it leads to leak uninitialize heap memory to clients. When the X server runs with elevated privileges. This flaw can lead to ASLR bypass, which when combined with other flaws...

Updated matio packages fix security vulnerability

MatVarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdupvprintf when uninitialized memory is accessed. CVE-2019-17533...

PT-2020-3582 · Xorg +8 · Xorg-Server +8

Name of the Vulnerable Software and Affected Versions: Xorg-server versions prior to 1.20.9 Description: A flaw was found in the way xserver memory was not properly initialized, which could leak parts of server memory to the X client. In cases where the Xorg server runs with elevated privileges,...