GHSA-566X-HHRF-QF8M ordered_float:NotNan may contain NaN after panic in assignment operators

After using an assignment operators such as NotNan::addassign, NotNan::mulassign, etc., it was possible for the resulting NotNan value to contain a NaN. This could cause undefined behavior in safe code, because the safe NotNan::cmp method contains internal unsafe code that assumes the value is...

ordered_float:NotNan may contain NaN after panic in assignment operators

After using an assignment operators such as NotNan::addassign, NotNan::mulassign, etc., it was possible for the resulting NotNan value to contain a NaN. This could cause undefined behavior in safe code, because the safe NotNan::cmp method contains internal unsafe code that assumes the value is...

a2 (>=0.2.0, <=0.5.0-alpha.7), a2d (>=0.1.0, <=0.1.11) +5211 more potentially affected by CVE-2020-35910 +4 more via lock_api (>=0.1.5, <=0.3.4)

lockapi CARGO version =0.1.5, =0.2.0, =0.1.0, =0.5.3, =0.1.0, =0.2.1, =0.1.1, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.9.1 and more Source cves: CVE-2020-35910, CVE-2020-35911, CVE-2020-35912, CVE-2020-35913, CVE-2020-35914 Source advisory: OSV:GHSA-HJ9H-WRGG-HGMX...

a2 (>=0.2.0, <=0.5.0-alpha.7), a2d (>=0.1.0, <=0.1.11) +5211 more potentially affected by CVE-2020-35910 +4 more via lock_api (>=0.1.5, <=0.3.4)

lockapi CARGO version =0.1.5, =0.2.0, =0.1.0, =0.5.3, =0.1.0, =0.2.1, =0.1.1, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.9.1 and more Source cves: CVE-2020-35910, CVE-2020-35911, CVE-2020-35912, CVE-2020-35913, CVE-2020-35914 Source advisory: OSV:GHSA-VH4P-6J7G-F4J9...

GHSA-C9RV-3JMQ-527W Unexpected panic when decoding tokens in branca

Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding. The documentation stated that an error should have been reported instead...

Unexpected panic when decoding tokens in branca

Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding. The documentation stated that an error should have been reported instead...

Incorrect implementation in streebog

Internal update-sigma function was implemented incorrectly and depending on debug-assertions it could've caused an incorrect result or panic for certain inputs...

GHSA-39WR-F4FF-XM6P Incorrect implementation in streebog

Internal update-sigma function was implemented incorrectly and depending on debug-assertions it could've caused an incorrect result or panic for certain inputs...

GHSA-RFGG-VCCR-M46M Missing release of memory in sized-chunks

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic...

Use after free in portaudio-rs

Affected versions of this crate is not panic safe within callback functions streamcallback and streamfinishedcallback. The call to user-provided closure might panic before a mem::forget call, which then causes a use after free that grants attacker to control the callback function pointer. This...

GHSA-QPJR-CH72-2QQ4 Use after free in portaudio-rs

Affected versions of this crate is not panic safe within callback functions streamcallback and streamfinishedcallback. The call to user-provided closure might panic before a mem::forget call, which then causes a use after free that grants attacker to control the callback function pointer. This...

Missing release of memory in sized-chunks

Chunk: Array size is not checked when constructed with unit and pair. Array size is not checked when constructed with From. Clone and insertfrom are not panic-safe; A panicking iterator causes memory safety issues with them. InlineArray: Generates unaligned references for types with a large...

GHSA-X54V-QXXR-93QC Missing release of memory in sized-chunks

Chunk: Array size is not checked when constructed with unit and pair. Array size is not checked when constructed with From. Clone and insertfrom are not panic-safe; A panicking iterator causes memory safety issues with them. InlineArray: Generates unaligned references for types with a large...

Improper Input Validation in once_cell

If during the first dereference of Lazy the initialization function panics, subsequent dereferences will execute std::hints::unreachableunchecked. Applications with panic = "abort" are not affected, as there will be no subsequent dereferences...

GHSA-7J44-FV4X-79G9 Improper Input Validation in once_cell

If during the first dereference of Lazy the initialization function panics, subsequent dereferences will execute std::hints::unreachableunchecked. Applications with panic = "abort" are not affected, as there will be no subsequent dereferences...

Double free in linea

Affected versions of this crate did not properly implements the Matrix::zipelements method, which causes an double free when the given trait implementation might panic. This allows an attacker to corrupt or take control of the memory...

GHSA-RH89-X75F-RH3C Exposure of uninitialized memory in memoffset

Affected versions of this crate caused traps and/or memory unsafety by zero-initializing references. They also could lead to uninitialized memory being dropped if the field for which the offset is requested was behind a deref coercion, and that deref coercion caused a panic. The flaw was correcte...

GHSA-RXR4-X558-X7HW Double free in smallvec

If an iterator passed to SmallVec::insertmany panicked in Iterator::next, destructors were run during unwinding while the vector was in an inconsistent state, possibly causing a double free a destructor running on two copies of the same value. This is fixed in smallvec 0.6.3 by ensuring that the...

Double free in smallvec

If an iterator passed to SmallVec::insertmany panicked in Iterator::next, destructors were run during unwinding while the vector was in an inconsistent state, possibly causing a double free a destructor running on two copies of the same value. This is fixed in smallvec 0.6.3 by ensuring that the...

SUSE SLED15 / SLES15 Security Update : go1.15 (SUSE-SU-2021:2787-1)

The remote SUSE Linux SLED15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2787-1 advisory. Update to go1.15.15: - go47473 net/http: panic due to racy read of persistConn after handler panic CVE-2021-36221 bsc1189162 -...