68 matches found
CVE-2022-39224 Arbitrary shell execution when extracting or listing files contained in a malicious rpm.
Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the extract and files methods of the RPM::File class of this...
CVE-2022-39224
Arr-pm is a Ruby RPM reader/writer library. Versions prior to 0.0.12 are vulnerable to OS command injection when the RPM contains a malicious payload compressor field, affecting the RPM::File::extract and RPM::File::files methods. Version 0.0.12 patches these issues. A workaround is to ensure RPM...
GHSA-88CV-MJ24-8W3Q arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.
Impact Arbitrary shell execution is possible when using RPM::Filefiles and RPM::Fileextract if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the extract and files methods of the RPM::File class in the affected versions of this library. Patches Version 0.0.12 ...
CVE-2022-39224: Improper Neutralization of Special Elements used in an OS Command
Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the extract and files methods of the RPM::File class of this...
Malicious code in nuique-random-arr-y (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8944275bf57308caccda8e710df70f752ccdb2562e0efb3bad97812ea26eee3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of the Generic-array module in Rust, related to type handling errors, allows attackers to cause service failures.
The vulnerability of the Generic-array module in Rust is related to the increased lifespan of the arr! macro. Exploiting this vulnerability allows a remote attacker to cause service failures...
GHSA-3358-4F7F-P4J4 Use after free in generic-array
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...
Use after free in generic-array
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...
Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr
arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...
Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr
arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...
CVE-2020-36465
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...
CVE-2020-36465
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...
CVE-2020-36465
The CVE-2020-36465 issue affects the Rust generic-array crate before 0.13.3. The root cause is a soundness problem caused by using the arr! macro to extend lifetimes. This aligns with multiple sources describing a memory-safety/soundness vulnerability in generic-array (pre-0.13.3). The connected ...
CVE-2020-36465
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...
CVE-2020-36465: Undefined Security Weakness
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...
GHSA-W8F3-PVX4-4C3H Prototype Pollution in arr-flatten-unflatten
All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor...
Prototype Pollution in arr-flatten-unflatten
All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor...
Prototype Pollution in quernest/arr-flatten-unflatten
Description arr-flatten-unflatten is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var arrFlattenUnflatten = require"arr-flatten-unflatten" console.log"Before : " + .polluted; arrFlattenUnflatten.unflatten'protopolluted': 'Yes! Its Polluted';...
Unspecified vulnerability in Mozilla Rust arr crate
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Mozilla Rust versions prior to 2020-08-25 in arr crate, which stems from a buffer overflow in Index and IndexMut. No details of the vulnerability are provided at this time...
