12675 matches found
apple-opensource-downloader (0.1.0), async_bagit (>=0.1.0, <=0.2.0) +14 more potentially affected by CVE-2025-62518 via tokio-tar (0.3.1)
tokio-tar CARGO version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-tar and may be impacted: - apple-opensource-downloader 0.1.0 - asyncbagit =0.1.0, =0.1.8, =0.8.0, =0.7.0, =0.2.0, =0.0.0, =0.1.0, =0.2.5, =0.4.0, =0.2.14, =0.6.0,...
mirror_sparse_matrix (>=0.1.1, <=0.1.17) potentially affected by unknown CVE via binary_vec_io (0.1.12)
binaryvecio CARGO version 0.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on binaryvecio and may be impacted: - mirrorsparsematrix =0.1.1, =0.1.17 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0109...
alpha-g-analysis (0.1.0), apecrunch (>=0.0.1, <=0.0.3) +179 more potentially affected by unknown CVE via ncurses (>=5.94.0, <=6.0.1)
ncurses CARGO version =5.94.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.7 - btui 0.6.5 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0108...
RUSTSEC-2025-0105 Uninitialized memory exposure in create_ring_buffer
The safe function createringbuffer allocates a buffer using Vec::withcapacity followed by setlen, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like writeslices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust's...
apple-opensource-downloader (0.1.0), async_bagit (>=0.1.0, <=0.2.0) +14 more potentially affected by CVE-2025-62518 via tokio-tar (0.3.1)
tokio-tar CARGO version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-tar and may be impacted: - apple-opensource-downloader 0.1.0 - asyncbagit =0.1.0, =0.1.8, =0.8.0, =0.7.0, =0.2.0, =0.0.0, =0.1.0, =0.2.5, =0.4.0, =0.2.14, =0.6.0,...
RUSTSEC-2025-0110 astral-tokio-tar Vulnerable to PAX Header Desynchronization
Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrect...
RUSTSEC-2025-0106 Undefined behavior in index_of_ptr with empty slices
The safe function indexofptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...
Undefined behavior in index_of_ptr with empty slices
The safe function indexofptr causes undefined behavior when called with an empty slice. The issue occurs in the line ptr.addslice.len - 1 which underflows when slice.len is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate...
PT-2025-46132
The safe function any as u8 slice can create byte slices that reference uninitialized memory when used with types containing padding bytes. The function uses slice::from raw parts to create a &u8 covering the entire size of a type, including padding bytes. According to Rust's documentation, from...
PT-2025-46130
The safe function create ring buffer allocates a buffer using Vec::with capacity followed by set len, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like write slices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust...
PT-2025-45714
The safe function create ring buffer allocates a buffer using Vec::with capacity followed by set len, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like write slices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust...
astral-tokio-tar 安全漏洞
astral-tokio-tar is a Rust library open-sourced by Astral. A security vulnerability exists in astral-tokio-tar versions prior to 0.5.6, which stems from inconsistent boundary parsing and could result in the contents of an interpreted file being a legal tar header...
nftnl (>=0.1.0, <=0.8.0) potentially affected by unknown CVE via mnl (>=0.1.0, <=0.2.3)
mnl CARGO version =0.1.0, =0.1.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0142...
alemat (>=0.3.0, <=0.8.0), box-bin (0.3.1) +19 more potentially affected by unknown CVE via unic-ucd-block (>=0.8.0, <=0.9.0)
unic-ucd-block CARGO version =0.8.0, =0.3.0, =0.3.0, =0.0.0, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =1.11.3, =0.0.0, =0.1.0, =1.1.1, =2.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0099...
actix-plus-auth (0.0.1), actix-plus-utils (0.1.0) +45 more potentially affected by unknown CVE via unic-ucd-category (>=0.5.0, <=0.9.0)
unic-ucd-category CARGO version =0.5.0, =0.3.0, =0.3.0, =0.2.0, =0.0.0, =0.0.102, =0.1.0, =0.0.7, =1.0.0, =0.0.1, =1.0.0 - if 0.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0094...
rev-up-your-harley (>=0.1.0, <=1.0.1), rustpython-vm (>=0.1.0, <=0.1.1) +2 more potentially affected by unknown CVE via unic-char (>=0.6.0, <=0.9.0)
unic-char CARGO version =0.6.0, =0.1.0, =0.1.0, =0.6.0, =0.7.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0086...
alemat (>=0.3.0, <=0.8.0), box-bin (0.3.1) +24 more potentially affected by unknown CVE via unic-ucd-common (>=0.7.0, <=0.9.0)
unic-ucd-common CARGO version =0.7.0, =0.3.0, =0.3.0, =0.0.0, =0.0.102, =0.1.0, =0.0.7, =0.0.1, =1.0.0, =1.11.3, =0.1.0, =0.0.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0101...
alemat (>=0.3.0, <=0.8.0), audio-processor-analysis (>=0.1.0-alpha.4, <=2.4.0) +100 more potentially affected by unknown CVE via unic-ucd-bidi (>=0.1.1, <=0.9.0)
unic-ucd-bidi CARGO version =0.1.1, =0.3.0, =0.1.0-alpha.4, =0.3.0, =0.4.0, =0.0.0, =0.2.4-beta, =0.7.0, =0.4.0, =0.7.0, =0.8.3 - druid-ui 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0083...