RUSTSEC-2024-0437 Crash due to uncontrolled recursion in protobuf crate

Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input. This allows an attacker to cause a stack overflow when parsing the mssage on untrusted data...

PT-2025-28031

Name of the Vulnerable Software and Affected Versions: protobuf crate for Rust versions prior to 3.7.2 Description: The issue allows uncontrolled recursion in the protobuf::coded input stream::CodedInputStream::skip group function when parsing unknown fields in untrusted input. This can occur due...

pqcrypto (>=0.12.2, <=0.16.1), pqcrypto-compat (0.1.0) potentially affected by unknown CVE via pqcrypto-hqc (>=0.0.4, <=0.1.6)

pqcrypto-hqc CARGO version =0.0.4, =0.12.2, =0.16.1 - pqcrypto-compat 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-753P-WRJ5-G8FJ...

Fedora: Security Advisory (FEDORA-2024-5a5f401785)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cosmwasm-check (>=1.1.0-rc.1, <=1.3.4), cw-check-contract (1.0.1) +2 more potentially affected by unknown CVE via cosmwasm-vm (>=1.2.8, <=1.3.4)

cosmwasm-vm CARGO version =1.2.8, =1.1.0-rc.1, =1.3.4 - cw-check-contract 1.0.1 - cw-desmos-dummy-tokenomics 0.0.3 - cw-desmos-filter-posts 0.1.4 Source cves: unknown CVE Source advisory: OSV:GHSA-VMQH-5232-V43R...

[SECURITY] Fedora 41 Update: rust-rbspy-0.24.0-3.fc41

Sampling CPU profiler for Ruby...

[SECURITY] Fedora 41 Update: rust-rustls-0.23.19-1.fc41

Rustls is a modern TLS library written in Rust...

[SECURITY] Fedora 40 Update: rust-rbspy-0.24.0-3.fc40

Sampling CPU profiler for Ruby...

[SECURITY] Fedora 40 Update: rust-rustls-0.23.19-1.fc40

Rustls is a modern TLS library written in Rust...

Fedora 40 : rust-rustls (2024-5a5f401785)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5a5f401785 advisory. Update to version 0.23.19. This version includes fix for RUSTSEC-2024-0399. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 41 : rust-rustls (2024-0d14d0d2f9)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0d14d0d2f9 advisory. Update to version 0.23.19. This version includes fix for RUSTSEC-2024-0399. Tenable has extracted the preceding description block directly from the Fedora...

gtk-layer-shell (>=0.1.0, <=0.8.2), hyprdock (>=0.3.0, <=0.4.1) +1 more potentially affected by unknown CVE via gtk-layer-shell-sys (>=0.0.1, <=0.7.0)

gtk-layer-shell-sys CARGO version =0.0.1, =0.1.0, =0.3.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0423...

acir (>=0.44.0, <=0.46.0), age (>=0.7.0, <=0.9.3) +114 more potentially affected by unknown CVE via pprof (>=0.3.23, <=0.13.0)

pprof CARGO version =0.3.23, =0.44.0, =0.7.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =1.0.8, =1.0.8, =1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-GW5W-5J7F-JMJJ...

boltchat (>=0.2.0, <=0.2.2), kanga-rpm-rs (0.7.0) +5 more potentially affected by CVE-2024-53857 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.1.0, =0.3.0, =0.3.2 Source cves: CVE-2024-53857 Source advisory: OSV:GHSA-4GRW-M28R-Q285...

boltchat (>=0.2.0, <=0.2.2), kanga-rpm-rs (0.7.0) +5 more potentially affected by CVE-2024-53856 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.1.0, =0.3.0, =0.3.2 Source cves: CVE-2024-53856 Source advisory: OSV:GHSA-9RMP-2568-59RV...

CVE-2024-53856

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1...

CVE-2024-53857

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys...

CVE-2024-53856

CVE-2024-53856 affects the rPGP library (Rust OpenPGP) where, prior to version 0.14.1, crafted data can trigger panics/crashes in rpgp (e.g., during parsing OpenPGP messages, decrypting, parsing keys, or signing). This can lead to a denial-of-service through program termination. The issue is fixe...

boltchat (>=0.2.0, <=0.2.2), kanga-rpm-rs (0.7.0) +5 more potentially affected by CVE-2024-53856 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.1.0, =0.3.0, =0.3.2 Source cves: CVE-2024-53856 Source advisory: OSV:RUSTSEC-2024-0447...

RUSTSEC-2024-0428 Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device`

An issue was identified in the VmFd::createdevice function, leading to undefined behavior and miscompilations on rustc 1.82.0 and newer due to the function's violation of Rust's pointer safety rules. The function downcasted a mutable reference to its struct kvmcreatedevice argument to an immutabl...