pcapplusplus:FuzzTarget: Bad-cast to pcpp::Layer from invalid vptr in pcpp::DnsLayer::parseResources

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5759079611629568 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000018fa10...

RUSTSEC-2020-0119 ReadTicket and WriteTicket should only be sendable when T is Send

Affected versions of this crate unconditionally implemented Send for ReadTicket & WriteTicket. This allows to send non-Send T to other threads. This can allows creating data races by cloning types with internal mutability and sending them to other threads as T of ReadTicket/WriteTicket. Such data...

exprtk:exprtk_fuzzer: Index-out-of-bounds in double exprtk::details::compute_pow10<double>

Project: https://github.com/ArashPartow/exprtk.git Detailed Report: https://oss-fuzz.com/testcase?key=6311682523267072 Project: exprtk Fuzzing Engine: libFuzzer Fuzz Target: exprtkfuzzer Job Type: libfuzzerubsanexprtk Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

Queue<T> should have a Send bound on its Send/Sync traits

Affected versions of this crate unconditionally implements Send/Sync for Queue. This allows 1 creating data races to a T: !Sync and 2 sending T: !Send to other threads, resulting in memory corruption or other undefined behavior...

RUSTSEC-2020-0133 Queue<T> should have a Send bound on its Send/Sync traits

Affected versions of this crate unconditionally implements Send/Sync for Queue. This allows 1 creating data races to a T: !Sync and 2 sending T: !Send to other threads, resulting in memory corruption or other undefined behavior...

PT-2020-17634

Name of the Vulnerable Software and Affected Versions scottqueue crate through 2020-11-15 Description An issue in the scottqueue crate allows unconditional implementations of Send and Sync for Queue, which can lead to creating data races to a T: !Sync and sending T: !Send to other threads. This...

CVE-2020-7772: Undefined Security Weakness

This affects the package doc-path before 2.1.2...

PT-2020-17626

Name of the Vulnerable Software and Affected Versions signal-simple crate versions through 2020-11-15 Description An issue was discovered in the signal-simple crate where there are unconditional implementations of Send and Sync for SyncChannel. This allows users to create undefined behavior in sa...

`LockWeak<T>` allows to create data race to `T`.

In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...

PT-2020-17635

Name of the Vulnerable Software and Affected Versions parc crate through 2020-11-14 Description An issue in the parc crate allows concurrent access to a non-Sync T, which can cause undefined behavior like data races. This is due to LockWeak unconditionally implementing Send without trait bounds o...

AtomicBox<T> lacks bound on its Send and Sync traits allowing data races

AtomicBox is a Box type designed to be used across threads, however, it implements the Send and Sync traits for all types T. This allows non-Send types such as Rc and non-Sync types such as Cell to be used across thread boundaries which can trigger undefined behavior and memory corruption...

`Shared` can cause a data race

Shared data structure in model crate implements Send and Sync traits regardless of the inner type. This allows safe Rust code to trigger a data race, which is undefined behavior in Rust. Users are advised to treat Shared as an unsafe type. It should not be used outside of the testing context, and...

AtomicBox<T> implements Send/Sync for any `T: Sized`

Affected versions of this crate implements Send/Sync for AtomicBox without requiring T: Send/T: Sync. This allows to create data races to T: !Sync and send T: !Send to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined...

PT-2020-17638 · Rust · Lever

Name of the Vulnerable Software and Affected Versions: lever crate versions prior to 0.1.1 Description: The issue concerns the implementation of the Send and Sync traits for all types T by AtomicBox, which is designed for use across threads. This implementation allows non-Send types, such as Rc,...

PT-2020-17620

Name of the Vulnerable Software and Affected Versions libsbc crate versions prior to 0.1.5 Description The issue allows Decoder to contain R: !Send and carry it to another thread, resulting in undefined behavior such as memory corruption from data race on R, or dropping R = MutexGuard from a thre...

PT-2020-17589

Name of the Vulnerable Software and Affected Versions may queue versions through 2020-11-10 Description An issue in the may queue crate for Rust can cause memory corruption due to the lack of bounds on its Send trait or Sync trait. This allows non-Sync types, such as Cell, to be shared across...

PT-2020-17580

Name of the Vulnerable Software and Affected Versions late-static crate versions prior to 0.4.0 Description An issue in the late-static crate allows a data race to occur because Sync is implemented for LateStatic with T: Send. This can result in a data race to a type T: Send + !Sync, such as Cell...

PT-2020-17621

Name of the Vulnerable Software and Affected Versions abox crate versions prior to 0.4.1 Description An issue in the abox crate allows the implementation of Send and Sync for AtomicBox without requiring T: Send and T: Sync. This enables the creation of data races to T: !Sync and sending T: !Send ...

PT-2020-17642

Name of the Vulnerable Software and Affected Versions model crate through 2020-11-10 Description An issue was discovered in the Shared data structure, which implements the Send and Sync traits without regard for the inner type. This allows safe Rust code to trigger a data race, which is undefined...

CVE-2020-27694: Undefined Security Weakness

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 has updated a specific critical library that may vulnerable to attack...