GHSA-FQ33-VMHV-48XH ntru-rs has unsound FFI: Wrong API usage causes write past allocated area

The following usage causes undefined behavior. rust let kp: ntru::types::KeyPair = …; kp.getpublic.exportDefault::default When compiled with debug assertions, the code above will trigger a attempt to subtract with overflow panic before UB occurs. Other mistakes e.g. using EncParams from a differe...

Unsound FFI: Wrong API usage causes write past allocated area

The following usage causes undefined behavior. rust let kp: ntru::types::KeyPair = …; kp.getpublic.exportDefault::default When compiled with debug assertions, the code above will trigger a attempt to subtract with overflow panic before UB occurs. Other mistakes e.g. using EncParams from a differe...

CentOS 8 : php:8.0 (CESA-2022:7624)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7624 advisory. - php: Use after free due to phpfilterfloat failing for ints CVE-2021-21708 - php: Uninitialized array in pgqueryparams leading to RCE CVE-2022-31625...

Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...

compu (>=0.1.0 <=0.2.0), fie (>=0.16.0 <=0.16.3) +2 more potentially affected by CVE-2020-36846 +1 more via compu-brotli-sys (=0.1.3)

compu-brotli-sys CARGO version =0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on compu-brotli-sys and may be impacted: - compu =0.1.0, =0.16.0, =1.0.0, =1.0.10 Source cves: CVE-2020-36846, CVE-2020-8927 Source advisory: OSV:GHSA-5V8V-66V8-MWM7...

GHSA-838H-JQP6-CF2F Sandbox bypass leading to arbitrary code execution in Deno

Impact The versions of Deno between release 1.18.0 and 1.20.2 inclusive are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass permission checks and execute arbitrary shell code. There is no evidence that this vulnerability has been...

GHSA-XVCG-2Q82-R87J Panic mishandled in libpulse-binding

An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface FFI boundary...

Panic mishandled in libpulse-binding

An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface FFI boundary...

CVE-2019-25055

An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface FFI boundary...

CVE-2019-25055

An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface FFI boundary...

CVE-2019-25055

The CVE-2019-25055 entry concerns the libpulse-binding crate for Rust (pre-2.6.0). The issue is a panic that is mishandled across an FFI boundary, causing undefined behavior. Affected versions prior to 2.6.0 expose a boundary error in the FFI during panic propagation; this is the underlying root ...

CVE-2019-25055

An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface FFI boundary...

GHSA-WCXC-JF6C-8RX9 Duplicate Advisory: Uncaught Exception in libpulse-binding

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xvcg-2q82-r87j. This link is maintained to preserve external references. Original Description Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB...

Duplicate Advisory: Uncaught Exception in libpulse-binding

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xvcg-2q82-r87j. This link is maintained to preserve external references. Original Description Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB...

addr2line (=0.6.0), backtrace (>=0.3.6 <=0.3.9) +11 more potentially affected by CVE-2021-25901 via lazy-init (>=0.1.1 <=0.3.0)

lazy-init CARGO version =0.1.1, =0.3.6, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.4.0, =0.4.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2021-25901 Source advisory: OSV:GHSA-W47J-HQPF-QW9W...

GHSA-69FV-GW6G-8CCG Potential memory corruption in arrayfire

The attribute repr added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain. arrayfire crates = version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28. The issue seems to be interlink...

Potential memory corruption in arrayfire

The attribute repr added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain. arrayfire crates = version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28. The issue seems to be interlink...

[SECURITY] Fedora 34 Update: rust-gettext-sys-0.21.2-1.fc34

Raw FFI bindings for gettext...

Fedora: Security Advisory for rust-gettext-sys (FEDORA-2021-79ce3cb64a)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-aom-sys (FEDORA-2021-1c3f7963a5)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...