Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code

Because of incorrect bounds on method Secp256k1::preallocatedgennew it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the context as a mutable reference and return...

RUSTSEC-2020-0105 Update unsound DrainFilter and RString::retain

Affected versions of this crate contained code from the Rust standard library that contained soundness bugs rust-lang/rust60977 double drop & rust-lang/rust78498 create invalid utf-8 string. The flaw was corrected in v0.9.1 by making a similar fix to the one made in the Rust standard library...

Update unsound DrainFilter and RString::retain

Affected versions of this crate contained code from the Rust standard library that contained soundness bugs rust-lang/rust60977 double drop & rust-lang/rust78498 create invalid utf-8 string. The flaw was corrected in v0.9.1 by making a similar fix to the one made in the Rust standard library...

PT-2020-17585

Name of the Vulnerable Software and Affected Versions abi stable crate versions prior to 0.9.1 Description The issue concerns soundness bugs in the abi stable crate for Rust, where a retain call can create an invalid UTF-8 string and DrainFilter lacks soundness due to a double drop. These bugs ar...

PT-2020-17584

Name of the Vulnerable Software and Affected Versions abi stable crate versions prior to 0.9.1 Description The issue is related to soundness bugs in the abi stable crate for Rust, specifically due to a double drop in DrainFilter and the potential creation of an invalid UTF-8 string. This could le...