CVE-2019-25007

Summary : The vulnerability CVE-2019-25007 affects the Rust streebog crate prior to 0.8.0. Root cause : incorrect implementation of the internal update-sigma function, which could cause a panic for certain inputs. Impact : panics in the Streebog hash function; no exploit details are provided in t...

CVE-2019-25009

CVE-2019-25009 — Rust http crate vulnerability : Affected component is the http crate (pre-0.1.20). The issue lies in the HeaderMap::Drain API, which can use a raw pointer, defeating soundness and potentially leading to memory-safety problems. This affects Rust projects depending on that crate. T...

CVE-2019-25009

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness...

CVE-2019-25010

CVE-2019-25010 affects the Rust failure crate (up to 0.1.5, affected through 2019-11-13). The issue is a type confusion that can occur when private_get_type_id is overridden, enabling potential misbehavior in applications relying on this crate. The NVD CVSS data indicates high to critical impact ...

CVE-2019-25010

An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when privategettypeid is overridden...

CVE-2019-25010

An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when privategettypeid is overridden...

CVE-2020-35858

The CVE-2020-35858 issue affects the prost crate for Rust prior to 0.6.1, where decoding a crafted message can cause stack consumption leading to denial of service (notably on x86) and potentially remote code execution (e.g., on ARM). The root cause is a stack-related flaw in parsing untrusted in...

CVE-2020-35860

CVE-2020-35860 affects the Rust crate cbox (through 2020-03-19). The root cause is described as the CBox API allowing dereferencing raw pointers without requiring unsafe code, which can lead to memory-safety issues. The vulnerability is documented across multiple sources (e.g., RustSec advisory R...

CVE-2020-35860

An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code...

CVE-2020-35861

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

CVE-2020-35861

The CVE-2020-35861 issue affects the bumpalo crate for Rust, specifically before version 3.2.1. The realloc functionality can read unknown memory, potentially allowing attackers to read cryptographic keys. No exploit details are provided in the initial/connected documents beyond this description....

CVE-2020-35862

An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free...

CVE-2020-35863

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface...

CVE-2020-35863

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface...

CVE-2020-35863

The CVE-2020-35863 entry concerns the hyper crate for Rust prior to 0.12.34, where HTTP request smuggling can lead to remote code execution in certain loopback HTTP server scenarios. Affected component: hyper (Rust crate); root cause: unsafe handling of HTTP requests enabling request smuggling an...

CVE-2020-35864

An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. readscalar and readscalarat can transmute values without unsafe blocks...

CVE-2020-35867

The CVE-2020-35867 issue affects the rusqlite crate for Rust prior to version 0.23.0, where memory safety can be violated via create_module. Multiple sources (including Red Hat, OSV/GHSA advisories) describe memory-safety vulnerabilities in rusqlite before 0.23.0, with issues such as use-after-fr...

CVE-2020-35867

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via createmodule...

CVE-2020-35868

CVE-2020-35868 affects the rusqlite crate for Rust prior to 0.23.0. Reported as memory-safety issues such as use-after-free and data races (UnlockNotification, VTab/VTabCursor, Auxdata API, and related paths) that could violate memory safety. The CVE entry is supported by multiple vulnerability r...

CVE-2020-35869

CVE-2020-35869 affects the Rust rusqlite crate prior to 0.23.0. The issue is a memory safety vulnerability caused by rusqlite::trace::log mishandling format strings, with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8). Remediation: upgrade to rusqlite 0.23.0 or later. Current documents d...