OPENSUSE-SU-2022:0148-1 Security update for varnish

This update for varnish fixes the following issues: varnish was updated to release 7.1.0 boo1195188 CVE-2022-23959 VCL: It is now possible to assign a BLOB value to a BODY variable, in addition to STRING as before. VMOD: New STRING strftimeTIME time, STRING format function for UTC formatting...

[SECURITY] Fedora 35 Update: rust-1.58.1-1.fc35

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...

Fedora: Security Advisory for rust (FEDORA-2022-1bafa3fc91)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Out-of-bounds Write in actix-web

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption...

RUSTSEC-2022-0008 Delegate functions are missing `Send` bound

Affected versions of this crate did not require event handlers to have Send bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior. The flaw was corrected in commit afe3252 by adding Send bounds...

[SECURITY] Fedora 35 Update: rust-1.56.1-1.fc35

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...

Mozilla: Use-after-free in HTTP2 Session object

The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash...

SUSE-RU-2021:14818-1 Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: implement new socket option PRSockOptDontFrag support larger DNS records by increasing the default buffer size for DNS queries Lock access to PRCallOnceType members in PRCallOnce for thread safety...

SUSE-RU-2021:3115-2 Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: implement new socket option PRSockOptDontFrag support larger DNS records by increasing the default buffer size for DNS queries Lock access to PRCallOnceType members in PRCallOnce for thread safety...

SUSE-RU-2021:3116-1 Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: implement new socket option PRSockOptDontFrag support larger DNS records by increasing the default buffer size for DNS queries Lock access to PRCallOnceType members in PRCallOnce for thread safety...

SUSE-RU-2021:3115-1 Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: implement new socket option PRSockOptDontFrag support larger DNS records by increasing the default buffer size for DNS queries Lock access to PRCallOnceType members in PRCallOnce for thread safety...

GHSA-7MG7-M5C3-3HQJ Data races in unicycle

Affected versions of this crate unconditionally implemented Send & Sync for types PinSlab & Unordered. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads. This can result in a data race & memory corruption when types that provide...

GHSA-9J8Q-M9X5-9G6J Data races in async-coap

An issue was discovered in the async-coap crate through 2020-12-08 for Rust. Affected versions of this crate implement Send/Sync for ArcGuard with no trait bounds on RC. This allows users to send RC: !Send to other threads and also allows users to concurrently access Rc: !Sync from multiple...

Data race in abox

Affected versions of this crate implements Send/Sync for AtomicBox without requiring T: Send/T: Sync. This allows to create data races to T: !Sync and send T: !Send to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined...

GHSA-R2X6-VRXX-JGV4 Data races in multiqueue

Affected versions of this crate unconditionally implemented Send for types used in queue implementations InnerSend, InnerRecv, FutInnerSend, FutInnerRecv. This allows users to send non-Send types to other threads, which can lead to data race bugs or other undefined behavior...

GHSA-HXW9-JXQW-JC8J Data races in dces

An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. This allows non-thread safe EntityStore and ComponentStores to be sent across threads and cause data races...

GHSA-W3G5-2848-2V8R Data races in generator

The Generator type is an iterable which uses a generator function that yields values. In affected versions of the crate, the provided function yielding values had no Send bounds despite the Generator itself implementing Send. The generator function lacking a Send bound means that types that are...

GHSA-PWHF-7427-9VV2 Non-atomic writes in cgc

Multiple soundness issues in Ptr in cgc Affected versions of this crate have the following issues: 1. Ptr implements Send and Sync for all types, this can lead to data races by sending non-thread safe types across threads. 2. Ptr::get violates mutable alias rules by returning multiple mutable...

Segmentation fault in time

Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library. The...

GHSA-F3MQ-99JR-WW4R Multiple soundness issues in cgc

Affected versions of this crate have the following issues: 1. Ptr implements Send and Sync for all types, this can lead to data races by sending non-thread safe types across threads. 2. Ptr::get violates mutable alias rules by returning multiple mutable references to the same object. 3. Ptr::writ...