tremor-language-server (>=0.7.3, <=0.7.4) potentially affected by CVE-2021-45701 +1 more via tremor-script (0.7.2)

tremor-script CARGO version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on tremor-script and may be impacted: - tremor-language-server =0.7.3, =0.7.4 Source cves: CVE-2021-45701, CVE-2021-45702 Source advisory: OSV:GHSA-3PP4-64MP-9CG9...

GHSA-6692-8QQF-79JC Duplicate Advisory: `Read` on uninitialized buffer may cause UB ('tectonic_xdv' crate)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qwvx-c8j7-5g75. This link is maintained to preserve external references. Original Description Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. Arbitrary Read...

Miscomputed sha2 results when using AVX2 backend

The v0.9.7 release of the sha2 crate introduced a new AVX2-accelerated backend which was automatically enabled for all x86/x8664 CPUs where AVX2 support was autodetected at runtime. This backend was buggy and would miscompute results for long messages i.e. messages spanning multiple SHA blocks. T...

abstract-boot (>=0.2.0-beta.4, <=0.2.0-beta.7), ace-test-lib (0.1.0) +711 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - abstract-boot =0.2.0-beta.4, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.8.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more...

A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in TCellOwner and TLCellOwner, giving unsound access to cell memory. This could take the form of getting two mutable references to the same memory, or ...

optra (>=0.1.0, <=0.2.1) potentially affected by CVE-2021-45694 via rdiff (0.1.2)

rdiff CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on rdiff and may be impacted: - optra =0.1.0, =0.2.1 Source cves: CVE-2021-45694 Source advisory: OSV:GHSA-Q579-9WP9-GFP2...

acid-store (>=0.2.0, <=0.11.2), acidalia (>=0.1.0, <=0.1.3) +1252 more potentially affected by CVE-2021-45707 via nix (>=0.16.1, <=0.20.0)

nix CARGO version =0.16.1, =0.2.0, =0.1.0, =0.1.0, =0.0.2, =4.3.1, =0.0.9, =0.1.0, =0.5.4-rc.1, =0.1.0, =0.5.0, =0.10.0, =0.13.0 - albedo 0.0.1-beta.0 and more Source cves: CVE-2021-45707 Source advisory: OSV:GHSA-WGRG-5H56-JG27...

`mopa` is technically unsound

The mopa crate redefines the deprecated TraitObject struct from core::raw like so: rust reprC deriveCopy, Clone dochidden pub struct TraitObject pub data: mut , pub vtable: mut , This is done to then transmute a reference to a trait object &dyn Trait for any trait Trait into this struct and...

GHSA-M325-RXJV-PWPH Deserialization functions pass uninitialized memory to user-provided Read

Affected versions of this crate passed an uninitialized buffer to a user-provided Read instance in: deserializebinary deserializestring deserializeextensionothers deserializestringprimitive This can result in safe Read implementations reading from the uninitialized buffer leading to undefined...

GHSA-QQMC-HWQP-8G2W Use after free in lru crate

Lru crate has use after free vulnerability. Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop, will remove and free the value, and but it's still possible to access the reference of value which is already...

Use after free in lru crate

Lru crate has use after free vulnerability. Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop, will remove and free the value, and but it's still possible to access the reference of value which is already...

Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`

Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid. This allows an attacker to republish an existing PeerRecord with a different PeerId...

a2 (>=0.2.0, <=0.5.3), abci-rs (0.10.0) +5476 more potentially affected by unknown CVE via hyper (>=0.0.1, <=0.14.11)

hyper CARGO version =0.0.1, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.9.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F67M-9J94-QV9J...

GHSA-F67M-9J94-QV9J Parser creates invalid uninitialized value

Affected versions of this crate called mem::uninitialized in the HTTP1 parser to create values of type httparse::Header from the httparse crate. This is unsound, since Header contains references and thus must be non-null. The flaw was corrected by avoiding the use of mem::uninitialized, using...

Parser creates invalid uninitialized value

Affected versions of this crate called mem::uninitialized in the HTTP1 parser to create values of type httparse::Header from the httparse crate. This is unsound, since Header contains references and thus must be non-null. The flaw was corrected by avoiding the use of mem::uninitialized, using...

`Read` on uninitialized buffer may cause UB ( `read_entry()` )

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. There are two of such cases gooffsetlog::readentry & offsetlog::readentry. Arbitrary Read implementations can read from the uninitialized buffer memory exposure and also can return incorrect...

audir (0.1.0), com-impl (>=0.1.0, <=0.1.1) +6 more potentially affected by CVE-2021-45681 via derive-com-impl (0.1.1)

derive-com-impl CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on derive-com-impl and may be impacted: - audir 0.1.0 - com-impl =0.1.0, =0.3.0-alpha1, =0.3.0-alpha1, =0.3.0-alpha4 - dxgi 0.3.0-alpha4 - wic 0.3.0-alpha1 Source cves:...

GHSA-8GJ8-HV75-GP94 `SegQueue` creates zero value of any type

Affected versions of this crate called mem::zeroed to create values of a user-supplied type T. This is unsound e.g. if T is a reference type which must be non-null. The flaw was corrected by avoiding the use of mem::zeroed, using MaybeUninit instead...

a2 (>=0.5.0-alpha.6, <=0.5.0-alpha.7), abci-rs (0.2.0) +424 more potentially affected by unknown CVE via crossbeam-queue (>=0.1.2, <=0.2.0)

crossbeam-queue CARGO version =0.1.2, =0.5.0-alpha.6, =0.0.2, =0.0.1, =0.1.0-alpha.2, =0.1.5, =0.12.0, =0.5.0, =0.1.0, =0.3.0 - amethyst-navigation 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6888-WF7J-34JQ...

Channel creates zero value of any type

Affected versions of this crate called mem::zeroed to create values of a user-supplied type T. This is unsound e.g. if T is a reference type which must be non-null. The flaw was corrected by avoiding the use of mem::zeroed, using MaybeUninit instead...