GHSA-M3WW-7HRP-GW9W Drop of uninitialized memory in Ozone

An issue was discovered in the ozone crate through version 0.1.0 for Rust. Memory safety is violated because of the dropping of uninitialized memory...

NULL Pointer Dereference in cbox

An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code...

GHSA-3VJM-36RR-7QRQ NULL Pointer Dereference in cbox

An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code...

GHSA-VQX7-PW4R-29RR Out of bounds read in bumpalo

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

Out of bounds read in bumpalo

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

Use after free in rio

An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race...

GHSA-8RC5-MR4F-M243 Use after free in rio

An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race...

GHSA-6RHX-HQXM-8P36 Double free in http

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness...

Double free in http

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness...

Rust Failure Crate Vulnerable to Type confusion

Safe Rust code can implement malfunctioning privategettypeid and cause type confusion when downcasting, which is an undefined behavior. Users who derive Fail trait are not affected...

a3mo_lib (>=0.1.0, <=0.1.1), aaa_csv_challenge (0.1.0) +6415 more potentially affected by CVE-2019-25010 +1 more via failure (>=0.1.0, <=0.1.8)

failure CARGO version =0.1.0, =0.1.0, =0.0.1, =0.1.0-pre.1, =0.5.0, =0.3.0, =0.3.0-alpha.1, =0.1.0, =0.2.0-alpha.2 - accept-encoding-fork 0.2.0-alpha.3 and more Source cves: CVE-2019-25010, CVE-2020-25575 Source advisory: OSV:GHSA-R98R-J25Q-RMPR...

GHSA-FQPX-CQ8X-9WP4 Unaligned references in sized-chunks

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the InlineArray implementation, an unaligned reference may be generated for a type that has a large alignment requirement...

GHSA-WRVC-72W7-XPMJ Incorrect Comparison in sodiumoxide

An issue was discovered in the sodiumoxide crate starting with 0.2.0 and prior to 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties...

GHSA-G4RW-8M5Q-6453 Out of bounds access in rgb

Affected versions of rgb crate allow viewing and modifying data of any type T wrapped in RGB as bytes, and do not correctly constrain RGB and other wrapper structures to the types for which it is safe to do so. Safety violation possible for a type wrapped in RGB and similar wrapper structures: If...

Out of bounds access in rgb

Affected versions of rgb crate allow viewing and modifying data of any type T wrapped in RGB as bytes, and do not correctly constrain RGB and other wrapper structures to the types for which it is safe to do so. Safety violation possible for a type wrapped in RGB and similar wrapper structures: If...

Use after free in libflate

An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution...

GHSA-RPCM-WHQC-JFW8 Use after free in libflate

An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution...

Use after free in image

Affected versions of this crate would call Vec::setlen on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances. This could run Drop implementations on...

libp2p-dns (>=0.1.0, <=0.4.0), libp2p-floodsub (>=0.1.0, <=0.4.0) +13 more potentially affected by CVE-2019-15545 via libp2p-core (>=0.1.0, <=0.4.0)

libp2p-core CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0 Source cves: CVE-2019-15545 Source advisory: OSV:GHSA-4Q4X-67HX-5MPG...

GHSA-MH6H-F25P-98F8 Uncontrolled memory consumption in protobuf

Affected versions of this crate called Vec::reserve on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data...