`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

Impact An issue was discovered in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper, which can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array lengt...

gix-transport code execution vulnerability

The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution. PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo' This will launch a calculator on OS...

Fails to prohibit standard library access prior to initialization of Rust standard library runtime

Affected versions allow arbitrary caller-provided code to execute before the lifetime of main. If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are...

Use-after-free in `vec_insert_bytes`

Incorrect reallocation logic in the function vecinsertbytes causes a use-after-free. This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally. The mail-\ suite is unmaintained and the upstream sources have...

`tui` is unmaintained; use `ratatui` instead

The tui crate is no longer maintained. Consider using the ratatui crate instead...

impl `FromMdbValue` for bool is unsound

The implementation of FromMdbValue have several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of...

multipart is Unmaintained

The multipart crate is unmaintained. The author has archived the github repository. Alternatives: - multer - multiparty...

Guest-controlled out-of-bounds read/write on x86\_64

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ff4p-7xrq-q5r8. For more information see the GitHub-hosted security advisory...

safemem is unmaintained

The latest crates.io release was in 2019. The repository has been archived by the author. Migration - safemem::copyoverslice, srcidx, destidx, len; can be replaced with slice.copywithinsrcidx..srcidx+len, destidx; as of rust 1.37.0. - safemem::writebytesslice, byte; can be replaced with...

Incorrect signature verification on gzip-compressed install images

The coreos-installer is a program to fetch a disk image and stream it to a target disk. During the installation process the installation image gpg signatures are verified. The signature verification can be bypassed for gzip-compressed images due to a flaw in gzip coreos-installer wrapper. When th...

`daemonize` is Unmaintained

Last release was over four years ago. The crate contains undocumented unsafe behind safe fns. An issue inquiring as to possible updates has gone unanswered by the maintainer. Possible Alternatives The below list has not been vetted in any way and may or may not contain alternatives: - daemonize-m...

Bit-packing in Cranelift compiler causes silent overflow and miscompilation

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm For more information see the GitHub-hosted security advisory...

Brotli certificate decompression can allocate up to 1 GiB before authentication

The built-in Brotli certificate decompressor enabled by the non-default brotli crate feature bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can...

`Debug` impls for client session values expose TLS secrets

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output. Custom ClientSessionStore implementations that format these values with Debug for example, when logging could disclos...

Excessive allocated memory on the host when guests don't have stdio

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory...

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory...

WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory...

Double free in `StackVec::retain` when a predicate or element `Drop` panics

Summary StackVec::retain committed its new length to self.len only after its internal loop completed. If the retain predicate or a removed element's Drop implementation panicked before the loop finished, unwinding proceeded with self.len still equal to the original, pre-retain length, leaving...

`SinglyLinkedList::remove` dereferences a null link

In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, currentelm.next reads a null pointer. That is undefined behavior. The list head is a raw mut Node, and safe code can construct...

Memory corruption bug on `ApplyResult` type

The ApplyResult type contains a raw pointer to a C++ memory object and has a derived Clone implementation which creates a reference to this object without incrementing the associated reference counter. As a result, if an instance of ApplyResult is duplicated through Clone and both instances are...

Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

Impact The getdisjointmut method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. Patches This has been fixed in slab v0.4.11. Workarounds Avoi...

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file...

Denial of service because of stack overflow with malicious decompression input

A denial of service vulnerability was found in zlib-rs, triggered by specially constructed input. This input causes a stack overflow, resulting in the process using zlib-rs to crash. Impact Due to the way LLVM handles the zlib-rs codebase, tail calls were not guaranteed. This caused certain input...

Borsh serialization of HashMap is non-canonical

The borsh serialization of the HashMap did not follow the borsh specification. It potentially produced non-canonical encodings dependent on insertion order. It also did not perform canonicty checks on decoding. This can result in consensus splits and cause equivalent objects to be considered...

Heap Buffer overflow using c_chars_to_str function

The heap-buffer-overflow is triggered in the strlen function when handling the ccharstostr function in the dbn crate. This vulnerability occurs because the CStr::fromptr function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars arr...

Stack overflow when parsing specially crafted JSON ABI strings

Affected versions of the alloy-json-abi crate did not properly handle parsing of malformatted JSON ABI strings. The JsonAbi::parse method can be tricked into a stack overflow when processing specially crafted input. This stack overflow can lead to a crash of the application using this crate,...

gtk-rs GTK3 bindings - no longer maintained

The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...

dav1d AV1 decoder integer overflow

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0...

Improper comparison of different-length signatures

The Webhook::verify function incorrectly compared signatures of different lengths - the two signatures would only be compared up to the length of the shorter signature. This allowed an attacker to pass in v1, as the signature, which would always pass verification...

Marvin Attack: potential key recovery through timing sidechannels

Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. Patches No patch is yet available. The crypto-bigint migration...

`loopdev` crate is unmaintained; use 'loopdev-3` instead.

The loopdev crate was last released in Oct, 2021. It has been unable to build in Fedora 38 and above since April, 2023. The loopdev-3 crate is a maintained fork: https://github.com/stratis-storage/loopdev-3...

Unsoundness in `intern` methods on `intaglio` symbol interners

Affected versions of this crate have a stacked borrows violation when creating references to interned contents. All interner types are affected. The flaw was corrected in version 1.9.0 by reordering move and borrowing operations and storing interned contents by raw pointer instead of as a Box...

Aliasing violation in `OrdSet` insertion

Inserting into an im::OrdSet for example by collecting an iterator into one can violate Rust's aliasing rules: Miri reports a stacked borrows violation in sizedchunks::Chunk::forcecopy, which is called during insertion, where a shared borrow is invalidated by a unique borrow before the read throu...

Uninitalized memory read & leak caused by fuser crate

During creation of new libfuse session with fusesessionnew operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so...

Mis-typed WebAssembly tag imports can lead to GC heap corruption

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory...

fd_readdir copies uninitialized struct padding into guest memory

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory...

Rooting for GC values live across `try_call` may be missing, causing GC heap corruption

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory...

Use-after-free in interned values and cached function results

When an application reads an interned value's fields or uses that value as an input to a tracked function, Salsa must ensure that reusable storage has been validated for the current database revision. This prevents the value's fields and associated cached function results from being freed while i...

`unzip`: archive extraction is vulnerable to path traversal (zip-slip)

Summary Unzipper::unzip extracts each archive entry to a path built from the entry's raw, attacker-controlled name without any traversal check. A ZIP archive whose entry names contain ../ components or an absolute path can therefore cause files to be written outside the destination directory chos...

Panic on Decoding Short Hybrid Keys

The deserialization functions X25519MlKem768Draft00PrivateKey::decode X25519MlKem768Draft00PublicKey::decode and XWingKemDraft06PublicKey::decode would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 byt...

async-std has been discontinued

The async-std has been discontinued. Alternatives: - smol...

crossbeam-channel: double free on Drop

The internal Channel type's Drop method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption. Quoting from the upstream description in merge request \1187: The problem lies in the fact that dicardallmessages contained two paths that could le...

Unsound usages of `core::slice::from_raw_parts`

We consider asslice and asslicemut unsound because: the pointer with any bit patterns could be cast to the slice of arbitrary types. The pointer could be created by unsafe new and deprecated fromparts. We consider that fromparts should be removed in latest version because it will help trigger...

Segmentation fault due to use of uninitialized memory

When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convertzipdatetime". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the...

get-size is unmaintained

get-size's maintainer seems to be unreachable, with no commits and releases pushed for 1 year and no activity on the GitHub repo. get-size also depends on get-size-derive 0.1.3, which uses attribute-derive ^0.6 a version of the crate which uses the yanked crate proc-macro-error. Possible...

Unsoundness in anstream

When given a valid UTF8 string "ö\x1b😀", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \xc3\xb6 then \x1b then \xf0\x9f\x98\x80. When looping over "non-printable bytes" \x1b\xf0 will be considered as some non-printable sequence. This will produce a brok...

Degraded secret zeroization capabilities

Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies the Dalek crates, which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set. Impact The degraded...

Memory corruption, denial of service, and arbitrary code execution in libgit2

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are: The gitrevparsesingle function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the...

`conrod` is unmaintained

The crate conrod has been deprecated since version 0.62.0 released in December 2018. The functionality was split across multiple different crates, with the core functionality being transferred to conrodcore. An overview can be found in the conrod repository. If you have this crate in your...

Missing facility to signal rotation of a verified cryptographic identity

Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a n...