Archive
31 December 2020
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 6.5
Use after free in libpulse-binding
An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
-
Medium 6.5
HTTP Request smuggling in tiny_http
An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header.
-
Medium 4.7
Data races in atom
An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race.
-
Medium 5.5
Use after free in actix-service
An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
-
Medium 5.5
use-after-free vulnerability in Rust array-queue
An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free.
-
Medium 5.5
Out of bounds read in dync
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
-
Medium 4.7
MutexGuard::map can cause a data race in safe code
An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).
-
Medium 5.5
futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer
An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference.
-
Medium 5.5
Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
-
Medium 4.7
Data races in lock_api
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness.
-
Medium 5.5
Data races in futures-intrusive
An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data races of non-Sync types.
-
Medium 5.5
Mutable reference with immutable provenance in image
An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)
-
Medium 5.5
Reference counting error in pyo3
An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.
-
Medium 5.5
Unexpected panic when decoding tokens in branca
An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
-
Medium 5.5
socket2 invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
miow invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
mio invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
ordered_float:NotNan may contain NaN after panic in assignment operators
An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN.
-
Medium 5.5
Data races in try-mutex
An issue was discovered in the try-mutex crate before 0.3.0 for Rust. TryMutex<T> allows cross-thread sending of a non-Send type.
-
Medium 5.5
Data races in magnetic
An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
-
Medium 5.1
Improper random number generation in nanorand
An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.
-
Medium 5.5
Data races in thex
An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
-
Medium 4.7
Data races in concread
An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.