Archive
26 December 2021
Vulnerabilities first published on this day (UTC), newest first.
109 results · Clear filters · Feed
-
High 7.5
Use after free in libpulse-binding
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
-
High 7.5
Missing Initialization of Resource in pnet
An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
-
High 7.5
Panic mishandled in libpulse-binding
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
-
High 7.5
`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)
An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
-
High 7.5
vec-const attempts to construct a Vec from a pointer to a const slice
An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
-
High 7.5
QueryInterface should call AddRef before returning pointer
An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
-
High 7.5
Window may read from uninitialized memory locations in rdiff
An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
-
High 7.5
Allocation of Resources Without Limits or Throttling in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
-
High 7.5
Process crashes when the cell used as DepGroup is not alive
An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
-
High 7.5
Memory Safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
-
High 8.1
AtomicBucket<T> unconditionally implements Send/Sync
An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
-
High 7.5
Abomonation transmutes &T to and from &[u8] without sufficient constraints
An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
-
High 8.1
Race Condition in tokio
An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
-
High 7.5
Panic on incorrect date input to `simple_asn1`
An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
-
High 7.5
RustEmbed generated `get` method allows for directory traversal when reading files from disk
An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode.
-
High 7.5
Use After Free in rusqlite
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.
-
High 7.5
Use after free in lru crate
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
-
High 7.6
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RAX35 before 1.0.4.102, …
-
High 8.4
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects RBK352 before 4.4.0…
-
High 8.2
Certain NETGEAR devices are affected by authentication bypass. This affects R6900P before 1.3.3.140, R7000P before 1.3.…
-
High 8.2
NETGEAR XR1000 devices before 1.0.0.58 are affected by authentication bypass.
-
High 8.6
Certain NETGEAR devices are affected by weak cryptography. This affects D7000v2 before 1.0.0.62, D8500 before 1.0.3.50,…
-
High 7.4
Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.…
-
High 7.6
NETGEAR R8000 devices before 1.0.4.62 are affected by a buffer overflow by an authenticated user.
-
High 7.3
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects EX6000 before 1.0.0.38…
-
High 8.1
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6300v2 before 1.0.4.5…
-
High 7.3
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects CBR40 before 2.3.5.12,…
-
High 7.1
NETGEAR D6220 devices before 1.0.0.76 are affected by command injection by an authenticated user.
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects EX6120 before 1.0.0.66…
-
High 7.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects AC2100 before 1.2.0.88…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RAX200 before 1.0.3.10…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RAX75 before 1.0.3.106…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user . This affects RAX200 before 1.0.3.1…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RAX75 before 1.0.3.106…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7900P before 1.4.2.84…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7000 before 1.0.11.12…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7900 before 1.0.4.38,…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RAX200 before 1.0.4.12…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R8000 before 1.0.4.74,…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7850 before 1.0.5.74,…