9790 matches found
ffmpeg 安全漏洞
ffmpeg is a rust library by meh.individual developer. A security vulnerability exists in ffmpeg, which stems from the Firequalizer Filter may be forced to dereference null pointers, potentially resulting in a denial of service...
Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer
The safe function createringbuffer allocates a buffer using Vec::withcapacity followed by setlen, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like writeslices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust's...
GHSA-H5J3-CRG5-8JQM orx-pinned-vec has undefined behavior in index_of_ptr with empty slices
The safe function indexofptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...
CVE-2025-62518
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives...
RUSTSEC-2025-0105 Uninitialized memory exposure in create_ring_buffer
The safe function createringbuffer allocates a buffer using Vec::withcapacity followed by setlen, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like writeslices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust's...
mirror_sparse_matrix (>=0.1.1 <=0.1.17) potentially affected by unknown CVE via binary_vec_io (=0.1.12)
binaryvecio CARGO version =0.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on binaryvecio and may be impacted: - mirrorsparsematrix =0.1.1, =0.1.17 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0109...
orx-concurrent-bag (>=1.0.0 <=1.16.0), orx-concurrent-iter (>=1.0.0 <=1.22.1) +9 more potentially affected by unknown CVE via orx-pinned-vec (>=0.1.1 <=2.12.0)
orx-pinned-vec CARGO version =0.1.1, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.6.0, =2.14.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0106...
Undefined behavior in index_of_ptr with empty slices
The safe function indexofptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...
RUSTSEC-2025-0106 Undefined behavior in index_of_ptr with empty slices
The safe function indexofptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...
RUSTSEC-2025-0110 astral-tokio-tar Vulnerable to PAX Header Desynchronization
Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrect...
apple-opensource-downloader (=0.1.0), async_bagit (>=0.1.0 <=0.2.0) +11 more potentially affected by CVE-2025-62518 via tokio-tar (=0.3.1)
tokio-tar CARGO version =0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-tar and may be impacted: - apple-opensource-downloader =0.1.0 - asyncbagit =0.1.0, =0.1.8, =0.8.0, =0.2.0, =0.1.0, =0.2.5, =0.4.0, =0.6.0, =0.12.0, =0.1.0,...
alpha-g-analysis (=0.1.0), apecrunch (>=0.0.1 <=0.0.3) +179 more potentially affected by unknown CVE via ncurses (>=5.101.0 <=6.0.1)
ncurses CARGO version =5.101.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.7 - btui =0.6.5 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0108...
astral-tokio-tar 安全漏洞
astral-tokio-tar is a Rust library open-sourced by Astral. A security vulnerability exists in astral-tokio-tar versions prior to 0.5.6, which stems from inconsistent boundary parsing and could result in the contents of an interpreted file being a legal tar header...
CuPs (>=0.0.0 <=0.0.5), Druid_task1 (=0.1.0) +94 more potentially affected by unknown CVE via unic-ucd-bidi (>=0.1.1 <=0.9.0)
unic-ucd-bidi CARGO version =0.1.1, =0.0.0, =1.11.3, =0.3.0, =0.1.0-alpha.4, =0.3.0, =0.4.0, =0.2.4-beta, =0.7.0, =0.4.0, =0.5.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0083...
CuPs (>=0.0.0 <=0.0.5), IF (=0.0.0) +29 more potentially affected by unknown CVE via unic-ucd-hangul (>=0.8.0 <=0.9.0)
unic-ucd-hangul CARGO version =0.8.0, =0.0.0, =1.11.3, =0.3.0, =0.3.0, =0.2.4-beta, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =0.0.0, =0.0.111 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0079...
CuPs (>=0.0.0 <=0.0.5), Druid_task1 (=0.1.0) +318 more potentially affected by unknown CVE via unic-ucd-version (>=0.7.0 <=0.9.0)
unic-ucd-version CARGO version =0.7.0, =0.0.0, =1.11.3, =0.1.2, =0.1.0, =0.3.0, =0.1.0, =0.5.0, =0.5.0, =0.1.0-alpha.4, =2.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0098...
CuPs (>=0.0.0 <=0.0.5), IF (=0.0.0) +22 more potentially affected by unknown CVE via unic-ucd-age (>=0.5.0 <=0.9.0)
unic-ucd-age CARGO version =0.5.0, =0.0.0, =1.11.3, =0.3.0, =0.3.0, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =0.1.0, =0.0.0, =0.3.0, =0.3.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0102...
CuPs (>=0.0.0 <=0.0.5), Druid_task1 (=0.1.0) +321 more potentially affected by unknown CVE via unic-char-range (>=0.6.0 <=0.9.0)
unic-char-range CARGO version =0.6.0, =0.0.0, =1.11.3, =0.1.2, =0.1.0, =0.3.0, =0.1.0, =0.5.0, =0.5.0, =0.1.0-alpha.4, =2.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0075...
CuPs (>=0.0.0 <=0.0.5), Druid_task1 (=0.1.0) +319 more potentially affected by unknown CVE via unic-common (>=0.7.0 <=0.9.0)
unic-common CARGO version =0.7.0, =0.0.0, =1.11.3, =0.1.2, =0.1.0, =0.3.0, =0.1.0, =0.5.0, =0.5.0, =0.1.0-alpha.4, =2.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0080...