CVE-2024-58253

CVE-2024-58253 affects the Rust crate obfstr prior to 0.4.4. The issue is that the obfstr! argument type is not restricted to string slices, which can cause an invalid UTF-8 conversion and produce an invalid value. The vulnerability is tied to versions before 0.4.4; updating to 0.4.4 or later res...

Amazon Linux 2 : rust, --advisory ALAS2-2025-2804 (ALAS-2025-2804)

The version of rust installed on the remote host is prior to 1.82.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2804 advisory. The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::sethost...

CBL Mariner 2.0 Security Update: llvm / rust (CVE-2023-29932)

The version of llvm / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-29932 advisory. - llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component...

Azure Linux 3.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-27534)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27534 advisory. - A path traversal vulnerability exists in curl 8.0.0 SFTP implementation...

Azure Linux 3.0 Security Update: rust (CVE-2024-32884)

The version of rust installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-32884 advisory. - gitoxide is a pure Rust implementation of Git. gix-transport does not check the username part of a URL for tex...

CBL Mariner 2.0 Security Update: cmake / curl / mysql / rust (CVE-2024-9681)

The version of cmake / curl / mysql / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9681 advisory. - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent...

Amazon Linux AMI : rust (ALAS-2025-1956)

The version of rust installed on the remote host is prior to 1.68.2-1.66. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1956 advisory. libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build G...

PT-2025-24273

Name of the Vulnerable Software and Affected Versions user's crate for Rust affected versions not specified Description A flaw was found in the user's crate for Rust, allowing privilege escalation via incorrect group listing. This occurs when a user or process has fewer than exactly 1024 groups,...

CVE-2024-43806 affecting package rust for versions less than 1.72.0-9

CVE-2024-43806 affecting package rust for versions less than 1.72.0-9. A patched version of the package is available...

Internet Bug Bounty: `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods

The Rust Security Response WG disclosed a vulnerability in the std::process::Command module on Windows, where it incorrectly escaped arguments when invoking batch files. This allowed for bypassing the fix by including trailing whitespace or periods in the batch file name, which are ignored and...

afarray (>=0.1.0 <=0.15.1), b-table (>=0.1.0 <=0.2.1) +38 more potentially affected by unknown CVE via get-size-derive (>=0.1.2 <=0.1.3)

get-size-derive CARGO version =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.8.0, =0.1.0, =0.1.0, =0.3.1, =0.9.1, =0.0.6, =0.1.0, =0.8.0, =0.9.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0427...

An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.

...

CVE-2024-32884 affecting package rust for versions less than 1.75.0-9

CVE-2024-32884 affecting package rust for versions less than 1.75.0-9. A patched version of the package is available...

The vulnerability of the Cargo package manager in the Rust programming language allows a hacker to execute arbitrary code.

The vulnerability of the Cargo package manager in the Rust programming language is related to the ignoring of umask when extracting archives created on UNIX-like systems. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2022-0614 affecting package rust for versions less than 1.75.0-1

CVE-2022-0614 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-32215 affecting package rust for versions less than 1.75.0-1

CVE-2022-32215 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-0890 affecting package rust for versions less than 1.75.0-1

CVE-2022-0890 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks

A critical security flaw in the Rust standard library could be exploited to target Windows users and stage command injection attacks. The vulnerability, tracked as CVE-2024-24576, has a CVSS score of 10.0, indicating maximum severity. That said, it only impacts scenarios where batch files are...

PT-2024-2720

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.77.2 Description A critical security flaw in the Rust standard library could be exploited to target Windows users and stage command injection attacks. The vulnerability allows attackers to execute arbitrary shell...

BeerHolderBot (>=0.3.5 <=0.3.8), BiliupApi (>=0.1.0 <=0.1.7) +3724 more potentially affected by unknown CVE via yaml-rust (>=0.2.2 <=0.4.5)

yaml-rust CARGO version =0.2.2, =0.3.5, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =1.0.0, =0.1.0, =0.0.9, =0.0.1, =0.0.1, =0.2.0-alpha.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0320...