EulerOS Virtualization 2.10.0 : libssh2 (EulerOS-SA-2024-1529)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attacke...

crayon: ObjectPool creates uninitialized memory when freeing objects

As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order to write it to the pool storage...

GHSA-XFHW-6MC4-MGXF crayon: ObjectPool creates uninitialized memory when freeing objects

As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order to write it to the pool storage...

whoami stack buffer overflow on several Unix platforms

With versions of the whoami crate = 0.5.3 and = 0.5.3 and 1.0.1, calling any of the above functions also leads to a stack buffer overflow on these platforms: - Bitrig - DragonFlyBSD - FreeBSD - NetBSD - OpenBSD This occurs because of an incorrect definition of the passwd struct on those platforms...

EulerOS Virtualization 2.9.1 : openssh (EulerOS-SA-2024-1460)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote...

EulerOS Virtualization 2.9.0 : libssh2 (EulerOS-SA-2024-1470)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attacke...

EulerOS 2.0 SP10 : libssh2 (EulerOS-SA-2024-1317)

According to the versions of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass...

EulerOS 2.0 SP11 : libssh2 (EulerOS-SA-2024-1217)

According to the versions of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass...

EulerOS 2.0 SP11 : libssh2 (EulerOS-SA-2024-1239)

According to the versions of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass...

ardaku (0.1.0), ayaka-model (0.2.0) +6 more potentially affected by CVE-2024-28123 via wasmi (>=0.19.0, <=0.30.0)

wasmi CARGO version =0.19.0, =0.4.0, =0.1.0, =0.30.0 Source cves: CVE-2024-28123 Source advisory: OSV:GHSA-75JP-VQ8X-H4CQ...

vl-convert-rs (0.8.0) potentially affected by CVE-2024-27936 via deno_runtime (0.105.0)

denoruntime CARGO version 0.105.0 is affected by a known vulnerability. The following packages have a transitive dependency on denoruntime and may be impacted: - vl-convert-rs 0.8.0 Source cves: CVE-2024-27936 Source advisory: OSV:GHSA-M4PQ-FV2W-6HRW...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +398 more potentially affected by unknown CVE via gdk-sys (>=0.2.1, <=0.18.2)

gdk-sys CARGO version =0.2.1, =1.0.0, =0.2.0, =0.1.0, =0.0.1, =0.1.2, =0.1.0, =0.21.0, =0.30.1 - avr-vm 0.1.0 - awl 0.0.1 - bare-metrics-gui 0.1.0 - battery-savior 0.1.0 - bbfpromix 0.1.0 - beemovie-gui 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0418...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +397 more potentially affected by unknown CVE via atk-sys (>=0.3.4, <=0.18.2)

atk-sys CARGO version =0.3.4, =1.0.0, =0.2.0, =0.1.0, =0.0.1, =0.1.2, =0.2.0-alpha, =0.6.0, =0.21.0, =0.30.1 - avr-vm 0.1.0 - awl 0.0.1 - bare-metrics-gui 0.1.0 - battery-savior 0.1.0 - bbfpromix 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0416...

RUSTSEC-2024-0417 gtk-rs GTK3 bindings - no longer maintained

The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...

ashpd (>=0.2.0-beta-1, <=0.4.0), browser_crate (0.1.0) +35 more potentially affected by unknown CVE via gdkwayland-sys (>=0.15.3, <=0.18.2)

gdkwayland-sys CARGO version =0.15.3, =0.2.0-beta-1, =0.4.0, =0.22.0, =0.22.0, =0.22.0, =0.15.0, =0.1.0, =0.4.0, =2.0.0-beta.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0411...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +388 more potentially affected by unknown CVE via gtk-sys (>=0.3.4, <=0.18.2)

gtk-sys CARGO version =0.3.4, =1.0.0, =0.2.0, =0.1.0, =0.0.1, =0.1.2, =0.2.0-alpha, =0.21.0, =0.30.1 - avr-vm 0.1.0 - awl 0.0.1 - bare-metrics-gui 0.1.0 - battery-savior 0.1.0 - bbfpromix 0.1.0 - beemovie-gui 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0420...

ashpd (>=0.2.0-beta-1, <=0.4.0) potentially affected by unknown CVE via gdkwayland (>=0.15.5, <=0.17.0)

gdkwayland CARGO version =0.15.5, =0.2.0-beta-1, =0.4.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0410...

Stack buffer overflow with whoami on several Unix platforms

With versions of the whoami crate = 0.5.3 and = 0.5.3 and 1.0.1, calling any of the above functions also leads to a stack buffer overflow on these platforms: - Bitrig - DragonFlyBSD - FreeBSD - NetBSD - OpenBSD This occurs because of an incorrect definition of the passwd struct on those platforms...

RUSTSEC-2024-0020 Stack buffer overflow with whoami on several Unix platforms

With versions of the whoami crate = 0.5.3 and = 0.5.3 and 1.0.1, calling any of the above functions also leads to a stack buffer overflow on these platforms: - Bitrig - DragonFlyBSD - FreeBSD - NetBSD - OpenBSD This occurs because of an incorrect definition of the passwd struct on those platforms...

actix-session-surrealdb (>=0.1.0, <=0.1.5), bb8-surrealdb (>=0.1.0, <=0.1.3) +2 more potentially affected by CVE-2024-58366 via surrealdb (1.0.0-beta.9)

surrealdb CARGO version 1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-58366 Source advisory: OSV:GHSA-Q3GG-M8HR-H4X4...