arrow (>=0.14.0, <=4.4.0), blockbuffers (0.1.0) +43 more potentially affected by CVE-2020-35864 via flatbuffers (>=0.4.0, <=0.8.4)

flatbuffers CARGO version =0.4.0, =0.14.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 - libsnark 1.1.2 and more Source cves: CVE-2020-35864 Source advisory: OSV:RUSTSEC-2020-0009...

`read_scalar` and `read_scalar_at` allow transmuting values without `unsafe` blocks

The readscalar and readscalarat functions are unsound because they allow transmuting values without unsafe blocks. The following example shows how to create a dangling reference: fn main deriveCopy, Clone, PartialEq, Debug struct S&'static str; impl flatbuffers::EndianScalar for S fn...

PT-2020-17496

Name of the Vulnerable Software and Affected Versions flatbuffers crate through 2020-04-11 for Rust Description An issue was discovered in the read scalar and read scalar at functions, which are unsound because they allow transmuting values without unsafe blocks. This can lead to creating danglin...

arrow (>=0.14.0, <=0.15.1), blockbuffers (0.1.0) +9 more potentially affected by CVE-2019-25004 via flatbuffers (>=0.4.0, <=0.5.0)

flatbuffers CARGO version =0.4.0, =0.14.0, =0.1.8, =0.1.0, =0.0.5, =3.0.0, =1.0.0, =1.1.2, =1.2.0, =1.3.2 Source cves: CVE-2019-25004 Source advisory: OSV:RUSTSEC-2019-0028...

PT-2019-16421

Name of the Vulnerable Software and Affected Versions flatbuffers crate versions prior to 0.6.1 Description An issue in the flatbuffers crate for Rust allows arbitrary bytes to be reinterpreted as a bool, defeating soundness. The implementation of impl Follow for bool enables this reinterpretatio...