Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
442 results · page 8 of 9
Dec 31, 2020An issue was discovered in the concread crate before 0.2.6 for Rust.CVE-2020-35928 · Other software · Concread Project · reported by MITREMedium 4.7
An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.
- Product
- Concread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the thex crate through 2020-12-08 for Rust.CVE-2020-35927 · Other software · Thex Project · reported by MITREMedium 5.5
An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
- Product
- Thex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the nanorand crate before 0.5.1 for Rust.CVE-2020-35926 · Other software · Nanorand Project · reported by MITRECritical 9.8
An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.
- Product
- Nanorand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the magnetic crate before 2.0.1 for Rust.CVE-2020-35925 · Other software · Magnetic Project · reported by MITREMedium 5.5
An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
- Product
- Magnetic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the try-mutex crate before 0.3.0 for Rust.CVE-2020-35924 · Other software · Try-mutex Project · reported by MITREMedium 5.5
An issue was discovered in the try-mutex crate before 0.3.0 for Rust. TryMutex<T> allows cross-thread sending of a non-Send type.
- Product
- Try-mutex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust.CVE-2020-35923 · Other software · Ordered-float Project · reported by MITREMedium 5.5
An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN.
- Product
- Ordered-float
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the mio crate before 0.7.6 for Rust.CVE-2020-35922 · Other software · MIO Project · reported by MITREMedium 5.5
An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- Product
- MIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the miow crate before 0.3.6 for Rust.CVE-2020-35921 · Other software · Miow Project · reported by MITREMedium 5.5
An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- Product
- Miow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the socket2 crate before 0.3.16 for Rust.CVE-2020-35920 · Other software · Rust-lang · reported by MITREMedium 5.5
An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- Product
- Socket2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the net2 crate before 0.2.36 for Rust.CVE-2020-35919 · Other software · Net2 Project · reported by MITREMedium 5.5
An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- Product
- Net2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the branca crate before 0.10.0 for Rust.CVE-2020-35918 · Other software · Hakobaito · reported by MITREMedium 5.5
An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
- Product
- Branca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the pyo3 crate before 0.12.4 for Rust.CVE-2020-35917 · Other software · Pyo3 Project · reported by MITREMedium 5.5
An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.
- Product
- Pyo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the image crate before 0.23.12 for Rust.CVE-2020-35916 · Other software · Image-rs · reported by MITREMedium 5.5
An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)
- Product
- Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust.CVE-2020-35915 · Other software · Futures-intrusive Project · reported by MITREMedium 5.5
An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data races of non-Sync types.
- Product
- Futures-intrusive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the lock_api crate before 0.4.2 for Rust.CVE-2020-35914 · Other software · Lock API Project · reported by MITREMedium 4.7
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
- Product
- Lock API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the lock_api crate before 0.4.2 for Rust.CVE-2020-35913 · Other software · Lock API Project · reported by MITREMedium 4.7
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
- Product
- Lock API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the lock_api crate before 0.4.2 for Rust.CVE-2020-35912 · Other software · Lock API Project · reported by MITREMedium 4.7
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Product
- Lock API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the lock_api crate before 0.4.2 for Rust.CVE-2020-35911 · Other software · Lock API Project · reported by MITREMedium 4.7
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness.
- Product
- Lock API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the lock_api crate before 0.4.2 for Rust.CVE-2020-35910 · Other software · Lock API Project · reported by MITREMedium 5.5
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness.
- Product
- Lock API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the multihash crate before 0.11.3 for Rust.CVE-2020-35909 · Other software · Protocol · reported by MITREHigh 7.5
An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanitized data from a network server.
- Product
- Multihash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the futures-util crate before 0.3.2 for Rust.CVE-2020-35908 · Other software · Rust-lang · reported by MITREMedium 5.5
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
- Product
- Future-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the futures-task crate before 0.3.5 for Rust.CVE-2020-35907 · Other software · Rust-lang · reported by MITREMedium 5.5
An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference.
- Product
- Futures-task
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the futures-task crate before 0.3.6 for Rust.CVE-2020-35906 · Other software · Rust-lang · reported by MITREHigh 7.8
An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.
- Product
- Futures-task
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the futures-util crate before 0.3.7 for Rust.CVE-2020-35905 · Other software · Rust-lang · reported by MITREMedium 4.7
An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).
- Product
- Future-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust.CVE-2020-35904 · Other software · Crossbeam-channel Project · reported by MITREMedium 5.5
An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are.
- Product
- Crossbeam-channel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the dync crate before 0.5.0 for Rust.CVE-2020-35903 · Other software · Dync Project · reported by MITREMedium 5.5
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
- Product
- Dync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust.CVE-2020-35902 · Other software · Actix · reported by MITRECritical 9.8
An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.
- Product
- Actix-codec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust.CVE-2020-35901 · Other software · Actix · reported by MITREHigh 7.5
An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.
- Product
- Actix-http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the array-queue crate through 2020-09-26 for Rust.CVE-2020-35900 · Other software · Array-queue Project · reported by MITREMedium 5.5
An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free.
- Product
- Array-queue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the actix-service crate before 1.0.6 for Rust.CVE-2020-35899 · Other software · Actix · reported by MITREMedium 5.5
An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
- Product
- Actix-service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the actix-utils crate before 2.0.0 for Rust.CVE-2020-35898 · Other software · Actix · reported by MITRECritical 9.1
An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
- Product
- Actix-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 25, 2020An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust.CVE-2020-35711 · Other software · Arc-swap Project · reported by MITREHigh 7.5
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.
- Product
- Arc-swap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2020async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io).CVE-2020-26281 · Other software · http-rs · reported by GitHubMedium 6.8
async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body. One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request. Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the advers
- Product
- async-h1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2020In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific ciCVE-2020-26235 · Other software · time-rs · reported by GitHubMedium 5.3
In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.
- Product
- time
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2020An issue was discovered in the sized-chunks crate through 0.6.2 for Rust.CVE-2020-25796 · Other software · Sized-chunks Project · reported by MITREHigh 7.5
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the InlineArray implementation, an unaligned reference may be generated for a type that has a large alignment requirement.
- Product
- Sized-chunks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2020An issue was discovered in the sized-chunks crate through 0.6.2 for Rust.CVE-2020-25795 · Other software · Sized-chunks Project · reported by MITREHigh 7.5
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insert_from can have a memory-safety issue upon a panic.
- Product
- Sized-chunks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2020An issue was discovered in the sized-chunks crate through 0.6.2 for Rust.CVE-2020-25794 · Other software · Sized-chunks Project · reported by MITREHigh 7.5
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic.
- Product
- Sized-chunks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2020An issue was discovered in the sized-chunks crate through 0.6.2 for Rust.CVE-2020-25793 · Other software · Sized-chunks Project · reported by MITREHigh 7.5
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From<InlineArray<A, T>>.
- Product
- Sized-chunks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2020An issue was discovered in the sized-chunks crate through 0.6.2 for Rust.CVE-2020-25792 · Other software · Sized-chunks Project · reported by MITREHigh 7.5
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair().
- Product
- Sized-chunks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2020An issue was discovered in the sized-chunks crate through 0.6.2 for Rust.CVE-2020-25791 · Other software · Sized-chunks Project · reported by MITREHigh 7.5
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit().
- Product
- Sized-chunks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020An issue was discovered in the rand_core crate before 0.4.2 for Rust.CVE-2020-25576 · Other software · Rust-random · reported by MITRECritical 9.8
An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
- Product
- Rand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Sep 14, 2020An issue was discovered in the failure crate through 0.1.5 for Rust.CVE-2020-25575 · Other software · failure_project · reported by MITRECritical 9.8
An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010
- Product
- failure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordboats.gitlab.iogithub.com
Sep 14, 2020An issue was discovered in the http crate before 0.1.20 for Rust.CVE-2020-25574 · Other software · Hyper · reported by MITREHigh 7.5
An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).
- Product
- Http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust.CVE-2020-25573 · Other software · Linked-hash-map Project · reported by MITRECritical 9.8
An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint.
- Product
- Linked-hash-map
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2020A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitiCVE-2020-25016 · Other software · Rgb-rust Project · reported by MITRECritical 9.1
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
- Product
- Rgb-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2020The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures.CVE-2020-15093 · Other software · awslabs · reported by GitHubHigh 8.6
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.
- Product
- tough
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2020IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST commanCVE-2020-4378 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST command. IBM X-Force ID: 179157.
- Product
- Spectrum Scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 25, 2019An issue was discovered in the string-interner crate before 0.7.1 for Rust.CVE-2019-16882 · Other software · String-interner Project · reported by MITREHigh 7.5
An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw.
- Product
- String-interner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Sep 25, 2019An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust.CVE-2019-16881 · Other software · Portaudio-rs Project · reported by MITRECritical 9.8
An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.
- Product
- Portaudio-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Sep 25, 2019An issue was discovered in the linea crate through 0.9.4 for Rust.CVE-2019-16880 · Other software · Linea Project · reported by MITRECritical 9.8
An issue was discovered in the linea crate through 0.9.4 for Rust. There is double free in the Matrix::zip_elements method.
- Product
- Linea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.