203 matches found
openSUSE 16: git-cliff / git-cliff-bash-completion / git-cliff-fish-completion / etc (openSUSE-SU-2026:21584-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21584-1 advisory. Changes in git-cliff: - Update to version 2.13.1: Support more configuration file locations Add per-commit statistics Expose determined bump typ...
OPENSUSE-SU-2026:11528-1 wasm-bindgen-0.2.100-2.1 on GA media
These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed...
[SECURITY] Fedora 43 Update: rust-reqsign-aws-v4-3.0.1-2.fc43
AWS SigV4 signing implementation for reqsign...
CVE-2026-46673
Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth...
Amazon Linux 2023 : papers, papers-devel, papers-libs (ALAS2023-2026-1782)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1782 advisory. CVE-2026-46529 is a command injection vulnerability in Evince, Atril, and Xreader caused by missing quoting of shell-like input in evspawn in ev-application.c. CVE-2026-46529 An unsoundness issue...
[SECURITY] Fedora 44 Update: rust-astral_async_http_range_reader-0.11.0-2.fc44
A library for streaming reading of files over HTTP using range requests...
[SECURITY] Fedora 43 Update: rust-astral_async_http_range_reader-0.11.0-2.fc43
A library for streaming reading of files over HTTP using range requests...
CVE-2026-44983 smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow
smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption...
[SECURITY] Fedora 43 Update: rust-rpki-0.18.6-4.fc43
A library for validating and creating RPKI data...
[SECURITY] Fedora 42 Update: rust-astral-tokio-tar-0.6.1-1.fc42
A Rust implementation of an async TAR file reader and writer. This library does not currently handle compression, but it is abstract over all I/O readers and writers. Additionally, great lengths are taken to ensure that the entire contents are never required to be entirely resident in memory all ...
MAL-2026-3431 Malicious code in apkeep (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d545ff7c3c178485cfb49d0028c4c808e67d0ee0fddcb4b7b195c943bb07d888 The package pretends to be a fork of a legitimate Rust library and uses the identity of the original authors. During usage, the obfuscated code targets...
Malicious code in apkeep (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d545ff7c3c178485cfb49d0028c4c808e67d0ee0fddcb4b7b195c943bb07d888 The package pretends to be a fork of a legitimate Rust library and uses the identity of the original authors. During usage, the obfuscated code targets...
RUSTSEC-2026-0127 Integer overflow in `array::ReadWrite::new()` leading to potential memory corruption
In array::ReadWrite::new line 83 of accessor/src/array.rs, let bytes = mem::sizeof:: len can overflow usize when len is very large. In release mode, this silently wraps, potentially making bytes = 0. The mapper then maps with 0 bytes, and subsequent accesses e.g. readvolatileat lead to undefined...
The vulnerability of the libp2p-rust library server allows a hacker to trigger a service failure.
The vulnerability of the libp2p-rust library server is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...
Medium: rust-below
Issue Overview: tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size...
CVE-2026-2625
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager RPM file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an...
[SECURITY] Fedora 43 Update: rust-scx_layered-0.0.6-8.fc43
A highly configurable multi-layer BPF / user space hybrid scheduler used within schedext, which is a Linux kernel feature which enables implementing kernel thread schedulers in BPF and dynamically loading them. https://github.com/sched-ext/scx/tree/main...
[SECURITY] Fedora 44 Update: rust-scx_layered-0.0.6-8.fc44
A highly configurable multi-layer BPF / user space hybrid scheduler used within schedext, which is a Linux kernel feature which enables implementing kernel thread schedulers in BPF and dynamically loading them. https://github.com/sched-ext/scx/tree/main...
[SECURITY] Fedora 42 Update: rust-astral-tokio-tar-0.6.0-1.fc42
A Rust implementation of an async TAR file reader and writer. This library does not currently handle compression, but it is abstract over all I/O readers and writers. Additionally, great lengths are taken to ensure that the entire contents are never required to be entirely resident in memory all ...