Format string

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::setlen is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution...

Design/Logic Flaw

An issue was discovered in the oncecell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy...

Privilege escalation

An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion...

CVE-2019-16137

An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion...

Design/Logic Flaw

An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion...

CVE-2019-16144

An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield during API calls...

CVE-2019-16143

The CVE concerns the blake2 crate for Rust, affecting versions before 0.8.1. The root cause is incorrect block sizes when BLAKE2b/BLAKE2s are used with HMAC, causing MAC results to be computed with half the required sizes. Documents consistently describe miscalculation of MAC results (MacResult) ...

CVE-2019-16143

An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes...

CVE-2019-16142

The CVE-2019-16142 issue affects the renderdoc crate for Rust prior to 0.5.0, where multiple exposed methods take self by immutable reference. This design is incompatible with a mutable interior state and can be unsafe when called from multiple threads without synchronization. Reported across Red...

CVE-2019-16142

An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application...

CVE-2019-16141

An issue was discovered in the oncecell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy...

CVE-2019-16141

An issue was discovered in the oncecell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy...

CVE-2019-16138

CVE-2019-16138 affects the Rust image crate, specifically the HDR image format decoder, where Vec::set_len is invoked on an uninitialized vector, causing a use-after-free and potential arbitrary code execution. The issue impacts the image crate prior to version 0.21.3. According to the connected ...

CVE-2019-16138

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::setlen is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution...

CVE-2019-16138

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::setlen is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution...

CVE-2019-16137

CVE-2019-16137 affects the spin crate for Rust (before version 0.5.2) where the RwLock memory ordering is mishandled. The underlying issue can allow two writers to acquire the lock simultaneously, violating mutual exclusion. This is documented across multiple sources (NVD, Red Hat, SUSE, OSV, Git...

CVE-2019-16140

An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion...

fix unsound APIs that could lead to UB

Affected versions of this crate API could use uninitialized memory with some APIs in special cases, like use the API in none generator context. This could lead to UB. The flaw was corrected by This patch fixes all those issues above...

PT-2019-14536 · Rust · Http Crate

Name of the Vulnerable Software and Affected Versions: chttp crate versions prior to 0.1.3 Description: An issue was discovered in the chttp crate, where there is a use-after-free during buffer conversion. The From implementation for Vec was not properly implemented, returning a vector backed by...

memoffset crate for Rust information disclosure vulnerability

memoffset crate for Rust is a Rust-based package for calculating offsets for structural members and their spans. An information disclosure vulnerability exists in versions of memoffset crate for Rust prior to 0.5.0, which can be exploited by an unauthorized attacker to obtain sensitive informatio...