Multiple memory corruption vulnerabilities in safe APIs

The crate has the following vulnerabilities: - The public trait arenavec::common::AllocHandle allows the return of raw pointers through its methods allocate and allocateorextend. However, the trait is not marked as unsafe, meaning users of the crate may implement it under the assumption that the...

PT-2025-34571 · Crates.Io · Scratchpad

The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the...

PT-2025-34580 · Crates.Io · Scratchpad

The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the...

libxml2: Out-of-Bounds Read in libxml2

A flaw was found in libxml2. This vulnerability allows out-of-bounds memory access due to incorrect handling of return values in xmlPythonFileRead and xmlPythonFileReadRaw. This is caused by a mismatch between the length of the file in bytes vs the length in characters, as unicode characters can...

Linux Distros Unpatched Vulnerability : CVE-2025-21912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: rcar: Use rawspinlock to protect register access Use rawspinlock in order to fix spurious messages about invalid context when spinlock debugging is enable...

Linux Distros Unpatched Vulnerability : CVE-2025-21948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL pointer dereference issue in inputevent. BUG: KASAN: null-ptr-deref in...

Linux Distros Unpatched Vulnerability : CVE-2021-23134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the...

Linux Distros Unpatched Vulnerability : CVE-2022-50202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung task at miscopen 1, for there is a race window of AB-BA deadlock whi...

Linux Distros Unpatched Vulnerability : CVE-2025-23161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: vmd: Make vmddev::cfglock a rawspinlockt type The access to the PCI config space via pciops::read and pciops::write is a low-level hardware access. The...

Linux Distros Unpatched Vulnerability : CVE-2019-17052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ax25create in net/ax25/afax25.c in the AFAX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAPNETRAW, which means that unprivileged...

Linux Distros Unpatched Vulnerability : CVE-2019-17054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - atalkcreate in net/appletalk/ddp.c in the AFAPPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAPNETRAW, which means that unprivileged...

Linux Distros Unpatched Vulnerability : CVE-2024-9594

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue was discovered in the Kubernetes Image Builder versions = v0.1.37 where default credentials are enabled during the image build process when usi...

Linux Distros Unpatched Vulnerability : CVE-2023-52340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c maxsize threshold that can be consumed easily, e.g., leading to a denial of servic...

Linux Distros Unpatched Vulnerability : CVE-2025-21657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: schedext: Replace rqlock to rawspinrqlock in scxopsbypass scxopsbypass iterates all CPUs to...

jffs2: check that raw node were preallocated before writing summary

...

jffs2: check jffs2_prealloc_raw_node_refs() result in few other places

...

RUSTSEC-2025-0051 `xcb::Connection::connect_to_fd*` functions violate I/O safety

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd such as a UnixStream as the file...

`xcb::Connection::connect_to_fd*` functions violate I/O safety

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd such as a UnixStream as the file...

PT-2025-34467 · Crates.Io · Xcb

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd such as a UnixStream as the file...

Linux Distros Unpatched Vulnerability : CVE-2024-35819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - soc: fsl: qbman: Use raw spinlock for cgrlock smpcallfunction always runs its callback in hard IRQ context, even on PREEMPTRT, where spinlocks can sleep. So we...