[SECURITY] Fedora 39 Update: rust-sequoia-sq-0.37.0-3.fc39

Command-line frontends for Sequoia...

[SECURITY] Fedora 39 Update: rust-sequoia-gpg-agent-0.4.2-1.fc39

A library for interacting with GnuPG's gpg-agent...

Fedora 40 : rust-sequoia-chameleon-gnupg / rust-sequoia-gpg-agent / etc (2024-12f0caa904)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-12f0caa904 advisory. - Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. - Update the sequoia-keystore crate to version 0.5.1. - Update the...

CVE-2024-39697: Improper Access Control

phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a...

Fedora 39 : rust-sequoia-chameleon-gnupg / rust-sequoia-gpg-agent / etc (2024-029752e60b)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-029752e60b advisory. - Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. - Update the sequoia-keystore crate to version 0.5.1. - Update the...

GHSA-74R5-G7VC-J2V2 zerovec-derive incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

zerovec-derive incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

ayaka-model (0.2.0), baked (1.0.0) +15 more potentially affected by unknown CVE via zerovec-derive (>=0.6.0, <=0.8.0)

zerovec-derive CARGO version =0.6.0, =0.6.0, =1.0.0-beta1 - icuproviderblob 1.0.0-beta1 - icusegmenter 1.0.0-alpha1 - icusegmenterlstm 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-74R5-G7VC-J2V2...

GHSA-XRV3-JMCP-374J zerovec incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

zerovec incorrectly uses `#[repr(packed)]`

The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...

ayaka-model (0.2.0), baked (1.0.0) +25 more potentially affected by unknown CVE via zerovec (>=0.2.3, <=0.8.1)

zerovec CARGO version =0.2.3, =0.3.0, =0.6.0, =0.5.0, =1.0.0-beta1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XRV3-JMCP-374J...

PT-2024-28635

Name of the Vulnerable Software and Affected Versions rust-phonenumber versions 0.3.4 through 0.3.5 Description The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by...

OESA-2024-1811 rust security update

Rust is a systems programming language focused on three goals:safety, speed,and concurrency.It maintains these goals without having a garbage collector, making it a useful language for a number of use cases other languages are not good at: embedding in other languages, programs with specific spac...

OESA-2024-1812 rust security update

Rust is a systems programming language focused on three goals:safety, speed,and concurrency.It maintains these goals without having a garbage collector, making it a useful language for a number of use cases other languages are not good at: embedding in other languages, programs with specific spac...

autometrics (>=0.3.0, <=0.3.2), dora-tracing (>=0.3.2-rc1, <=0.3.12) +16 more potentially affected by unknown CVE via opentelemetry_api (>=0.18.0, <=0.20.0)

opentelemetryapi CARGO version =0.18.0, =0.3.0, =0.3.2-rc1, =1.1.0, =0.0.2-alpha.1, =0.2.0, =0.18.0, =0.11.0, =0.10.0, =0.3.0, =0.1.0, =0.1.0, =0.3.2-rc.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0387...

CBL Mariner 2.0 Security Update: tensorflow / rust / curl (CVE-2023-32001)

The version of tensorflow / rust / curl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-32001 advisory. - Rejected reason: We issued this CVE pre-maturely, as we have subsequently realized that th...

CBL Mariner 2.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-28320)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-28320 advisory. - A denial of service vulnerability exists in curl v8.1.0 in the way libcurl...

CBL Mariner 2.0 Security Update: cloud-hypervisor / edk2 / hvloader / openssl (CVE-2022-4304)

The version of cloud-hypervisor / edk2 / hvloader / openssl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-4304 advisory. - A timing based side channel exists in the OpenSSL RSA Decryption...

CBL Mariner 2.0 Security Update: cloud-hypervisor / edk2 / hvloader / openssl / rust (CVE-2023-0286)

The version of cloud-hypervisor / edk2 / hvloader / openssl / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0286 advisory. - There is a type confusion vulnerability relating to X.400 addres...

CBL Mariner 2.0 Security Update: rust / tensorflow / cmake / mysql (CVE-2023-27537)

The version of rust / tensorflow / cmake / mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27537 advisory. - A double free vulnerability exists in libcurl 8.0.0 when sharing HSTS data betwee...