CVE-2020-35858

The CVE-2020-35858 issue affects the prost crate for Rust prior to 0.6.1, where decoding a crafted message can cause stack consumption leading to denial of service (notably on x86) and potentially remote code execution (e.g., on ARM). The root cause is a stack-related flaw in parsing untrusted in...

CVE-2020-35860

An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code...

CVE-2020-35860

CVE-2020-35860 affects the Rust crate cbox (through 2020-03-19). The root cause is described as the CBox API allowing dereferencing raw pointers without requiring unsafe code, which can lead to memory-safety issues. The vulnerability is documented across multiple sources (e.g., RustSec advisory R...

CVE-2020-35861

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

CVE-2020-35861

The CVE-2020-35861 issue affects the bumpalo crate for Rust, specifically before version 3.2.1. The realloc functionality can read unknown memory, potentially allowing attackers to read cryptographic keys. No exploit details are provided in the initial/connected documents beyond this description....

CVE-2020-35862

An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free...

CVE-2020-35863

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface...

CVE-2020-35863

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface...

CVE-2020-35863

The CVE-2020-35863 entry concerns the hyper crate for Rust prior to 0.12.34, where HTTP request smuggling can lead to remote code execution in certain loopback HTTP server scenarios. Affected component: hyper (Rust crate); root cause: unsafe handling of HTTP requests enabling request smuggling an...

CVE-2020-35864

An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. readscalar and readscalarat can transmute values without unsafe blocks...

CVE-2020-35867

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via createmodule...

CVE-2020-35867

The CVE-2020-35867 issue affects the rusqlite crate for Rust prior to version 0.23.0, where memory safety can be violated via create_module. Multiple sources (including Red Hat, OSV/GHSA advisories) describe memory-safety vulnerabilities in rusqlite before 0.23.0, with issues such as use-after-fr...

CVE-2020-35868

CVE-2020-35868 affects the rusqlite crate for Rust prior to 0.23.0. Reported as memory-safety issues such as use-after-free and data races (UnlockNotification, VTab/VTabCursor, Auxdata API, and related paths) that could violate memory safety. The CVE entry is supported by multiple vulnerability r...

CVE-2020-35869

CVE-2020-35869 affects the Rust rusqlite crate prior to 0.23.0. The issue is a memory safety vulnerability caused by rusqlite::trace::log mishandling format strings, with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8). Remediation: upgrade to rusqlite 0.23.0 or later. Current documents d...

CVE-2020-35869

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings...

CVE-2020-35871

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race...

CVE-2020-35871

CVE-2020-35871 concerns the Rust package rusqlite prior to 0.23.0, where memory safety can be violated via a data race in the Auxdata API. Connected sources (RH CVE, OSV advisories, and EU/NVD references) consistently identify data races affecting rusqlite before version 0.23.0, including issues ...

CVE-2020-35872

The CVE-2020-35872 entry concerns the rusqlite crate for Rust, before version 0.23.0. The root cause is a memory-safety issue exposed via the repr(Rust) type, which can lead to memory-safety violations. The vulnerability is reflected in high-severity CVSS scores (NVD: CVSS2 7.5; CVSS3.1 9.8) with...

CVE-2020-35874

An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-free...

CVE-2020-35874

CVE-2020-35874 relates to the Rust internment crate; ArcIntern::drop has a race that can lead to use-after-free. Affected: internment up to versions before 0.3.12. Impact: potential memory safety issue. Mitigation: upgrade to 0.3.12 or later, as the fix serializes access during deallocation. Othe...