Potential unaligned read

On windows, atty dereferences a potentially unaligned pointer. In practice however, the pointer won't be unaligned unless a custom global allocator is used. In particular, the System allocator on windows uses HeapAlloc, which guarantees a large enough alignment. atty is Unmaintained A Pull Reques...

RUSTSEC-2021-0145 Potential unaligned read

On windows, atty dereferences a potentially unaligned pointer. In practice however, the pointer won't be unaligned unless a custom global allocator is used. In particular, the System allocator on windows uses HeapAlloc, which guarantees a large enough alignment. atty is Unmaintained A Pull Reques...

Updated librsvg packages fix a security vulnerability

This update patches the vendored smallvec Rust crate in librsvg to fix a security vulnerability: The Iterator implementation mishandles destructors, leading to a double free CVE-2021-25900...

RUSTSEC-2021-0095 `mopa` is technically unsound

The mopa crate redefines the deprecated TraitObject struct from core::raw like so: rust reprC deriveCopy, Clone dochidden pub struct TraitObject pub data: mut , pub vtable: mut , This is done to then transmute a reference to a trait object &dyn Trait for any trait Trait into this struct and...

`mopa` is technically unsound

The mopa crate redefines the deprecated TraitObject struct from core::raw like so: rust reprC deriveCopy, Clone dochidden pub struct TraitObject pub data: mut , pub vtable: mut , This is done to then transmute a reference to a trait object &dyn Trait for any trait Trait into this struct and...

Rust Resource Management Error Vulnerability (CNVD-2021-38306)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in algorithmica crate for Rust version 2021-03-07 and earlier, which stems from a double free in merge sort::merge.No details of the vulnerability are available a...

RUSTSEC-2021-0146 Crate `twoway` deprecated by the author

The commit e99b3c7 releasing version 0.2.2 explicitly deprecates twoway in favour of memchr crate...

CVE-2021-29511

CVE-2021-29511 affects the Rust EVM implementation (evm crate). Before the patch in commit 19ade85, certain memory-opcodes using memory::copy_large could cause memory over-allocation, enabling a denial-of-service. Remediation: upgrade evm to >=0.26.1, or to specific newer releases (0.21.1, 0.2...

CVE-2021-29511 Memory over-allocation in evm crate

evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the evm crate can over-allocate memory when it is not needed, making it possible for an attacker to perform...

Unspecified Vulnerability in Rust (CNVD-2021-38316)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust rkyv crate versions prior to 0.6.0, which stems from the fact that when an archive is created via serialization, the contents of the archive may contain uninitialized valu...

anymap is unmaintained.

The anymap crate does not appear to be maintained, and the most recent published version 0.12.1 includes a soundness bug. This has been fixed a few years ago, but was never released...

abc-ecs (>=0.1.0, <=0.2.1), abc_game_engine (>=0.1.0, <=0.1.2) +308 more potentially affected by CVE-2021-38187 via anymap (>=0.10.3, <=1.0.0-beta.2)

anymap CARGO version =0.10.3, =0.1.0, =0.1.0, =1.0.0-alpha.1, =0.1.6, =0.1.0-alpha.2, =0.8.0, =0.1.0, =5.0.0, =5.2.2, =0.0.1-alpha+3, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.2 and more Source cves: CVE-2021-38187 Source advisory: OSV:RUSTSEC-2021-0065...

`cpuid-bool` has been renamed to `cpufeatures`

Please use the cpufeatures crate going forward: There will be no further releases of cpuid-bool...

CVE-2021-31996

An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in mergesort::merge...

Double free

An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in mergesort::merge...

CVE-2021-31996

CVE-2021-31996 affects the Rust crate algorithmica (up to 2021-03-07). The issue is a double free in merge_sort::merge(), where the function can duplicate and drop ownership of elements (T) without guarding against double-free when called on Vec. The Red Hat, OSV, and GitHub advisories corroborat...

Rust 资源管理错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in algorithmica crate for Rust version 2021-03-07 and earlier, which stems from a double free in merge sort::merge.No details of the vulnerability are available a...

CVE-2021-31919

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...

CVE-2021-31919

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...

Code injection

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...