85 matches found
MAL-2025-13826 Malicious code in @zalastax/nolb-react-ub (npm)
The package @zalastax/nolb-react-ub was found to contain malicious code...
CVE-2021-35296
An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Response Path...
ub-soft.de Cross Site Scripting vulnerability OBB-4036605
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2024-56661 tipc: fix NULL deref in cleanup_bearer()
In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanupbearer syzbot found 1 that after blamed commit, ub-ubsock-sk was NULL when attempting the atomicdec : atomicdec&tipcnetsocknetub-ubsock-sk-wqcount; Fix this by caching the tipcnet pointer. 1 Oops:...
CVE-2024-46823 kunit/overflow: Fix UB in overflow_allocation_test
In the Linux kernel, the following vulnerability has been resolved: kunit/overflow: Fix UB in overflowallocationtest The 'devicename' array doesn't exist out of the 'overflowallocationtest' function scope. However, it is being used as a driver name when calling 'kunitdrivercreate' from...
CVE-2024-46735 ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
In the Linux kernel, the following vulnerability has been resolved: ublkdrv: fix NULL pointer dereference in ublkctrlstartrecovery When two UBLKCMDSTARTUSERRECOVERY commands are submitted, the first one sets 'ubq-ubqdaemon' to NULL, and the second one triggers WARN in ublkqueuereinit and...
PT-2024-5866 · Nlnet +5 · Unbound +5
Name of the Vulnerable Software and Affected Versions: Unbound affected versions not specified Description: A NULL pointer dereference flaw was found in the ub ctx set fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentatio...
RUSTSEC-2024-0360 `XmpFile::close` can trigger UB
Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occured, it would trigger undefined behavior, typically a process abort. This is best demonstrated in issue 230, where a race condition causes the close call to fail due t...
The kstring integration in gix-attributes is unsound
gix-attributes in state::ValueRef unsafely creates a &str from a &u8 containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: rust // SAFETY: our API makes accessing that value as str impossible, so illformed...
GHSA-CX7H-H87R-JPGR The kstring integration in gix-attributes is unsound
gix-attributes in state::ValueRef unsafely creates a &str from a &u8 containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: rust // SAFETY: our API makes accessing that value as str impossible, so illformed...
Fedora 40 : glycin-loaders / gnome-tour / helix / helvum / libipuz / loupe / etc (2024-ce2936b568)
The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ce2936b568 advisory. This update contains builds from a mini-mass-rebuild for Rust applications and some C-style libraries. Rebuilding with the Rust 1.78 toolchain should fix...
Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the lifetime of main. If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are...
RUSTSEC-2023-0057 Fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the lifetime of main. If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are...
cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`
The function ChunkId::new creates a misaligned pointer by casting mutable pointer of u8 slice which has alignment 1 to the mutable pointer of u32 which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function...
Misaligned pointer dereference in `ChunkId::new`
The function ChunkId::new creates a misaligned pointer by casting mutable pointer of u8 slice which has alignment 1 to the mutable pointer of u32 which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function...
Code injection
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled...
Undefined Behavior in Rust runtime functions
Impact Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled with LLVM 16 which causes some writes, which are critical for correctness, to be...
ntru-rs has unsound FFI: Wrong API usage causes write past allocated area
The following usage causes undefined behavior. rust let kp: ntru::types::KeyPair = …; kp.getpublic.exportDefault::default When compiled with debug assertions, the code above will trigger a attempt to subtract with overflow panic before UB occurs. Other mistakes e.g. using EncParams from a differe...
Force cast a &Vec<T> to &[T]
In function Table::asref, a reference of vector is force cast to slice. There are multiple problems here: 1. To guarantee the size is correct, we have to first do Vec::shrinktofit. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is UB. 2. Even ...