3514 matches found
GHSA-3VJM-36RR-7QRQ NULL Pointer Dereference in cbox
An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code...
Out of bounds read in bumpalo
An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...
GHSA-VQX7-PW4R-29RR Out of bounds read in bumpalo
An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...
GHSA-8RC5-MR4F-M243 Use after free in rio
An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race...
Use after free in rio
An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race...
Double free in http
An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness...
GHSA-6RHX-HQXM-8P36 Double free in http
An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness...
DesignerHelper-rs (>=0.1.0 <=0.1.2), GetPDB (>=0.1.0 <=1.0.1) +6474 more potentially affected by CVE-2019-25010 +1 more via failure (>=0.1.0 <=0.1.8)
failure CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.4.0 - abscissacore =0.4.0 and more Source cves: CVE-2019-25010, CVE-2020-25575 Source advisory: OSV:GHSA-R98R-J25Q-RMPR...
Rust Failure Crate Vulnerable to Type confusion
Safe Rust code can implement malfunctioning privategettypeid and cause type confusion when downcasting, which is an undefined behavior. Users who derive Fail trait are not affected...
GHSA-FQPX-CQ8X-9WP4 Unaligned references in sized-chunks
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the InlineArray implementation, an unaligned reference may be generated for a type that has a large alignment requirement...
GHSA-WRVC-72W7-XPMJ Incorrect Comparison in sodiumoxide
An issue was discovered in the sodiumoxide crate starting with 0.2.0 and prior to 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties...
Out of bounds access in rgb
Affected versions of rgb crate allow viewing and modifying data of any type T wrapped in RGB as bytes, and do not correctly constrain RGB and other wrapper structures to the types for which it is safe to do so. Safety violation possible for a type wrapped in RGB and similar wrapper structures: If...
GHSA-G4RW-8M5Q-6453 Out of bounds access in rgb
Affected versions of rgb crate allow viewing and modifying data of any type T wrapped in RGB as bytes, and do not correctly constrain RGB and other wrapper structures to the types for which it is safe to do so. Safety violation possible for a type wrapped in RGB and similar wrapper structures: If...
Use after free in libflate
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution...
GHSA-RPCM-WHQC-JFW8 Use after free in libflate
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution...
Use after free in image
Affected versions of this crate would call Vec::setlen on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances. This could run Drop implementations on...
GHSA-MH6H-F25P-98F8 Uncontrolled memory consumption in protobuf
Affected versions of this crate called Vec::reserve on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data...
Uncontrolled recursion in ammonia
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization...
audrey (=0.1.0) potentially affected by CVE-2018-20992 via claxon (=0.2.1)
claxon CARGO version =0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on claxon and may be impacted: - audrey =0.1.0 Source cves: CVE-2018-20992 Source advisory: OSV:GHSA-8C6G-4XC5-W96C...