Open Source Vulnerabilities

rusqlite, rusqlite

Incorrect Lifetime Bounds on Closures in `rusqlite`

raw-cpuid

Optional `Deserialize` implementations lacking validation

qcell

A malicious coder can get unsound access to TCell or TLCell memory

rdiff

Window can read out of bounds if Read instance returns more bytes than buffer size

nix, nix, nix

Out-of-bounds write in nix::unistd::getgrouplist

neon

Use after free in Neon external buffers

nanorand

Aliased mutable references from `tls_rand` & `TlsWyRand`

metrics-util

AtomicBucket<T> unconditionally implements Send/Sync

mopa

`mopa` is technically unsound

messagepack-rs

Deserialization functions pass uninitialized memory to user-provided Read

lru

Use after free in lru crate

org.drools:drools-core

XML External Entity Reference in drools

joplin

Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

com.github.kfcfans:powerjob

Insufficiently Protected Credentials in PowerJob

spirv-tools

Stack-buffer-overflow in spvtools::opt::CompositeInsertToCompositeConstruct

libp2p-core

Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`

freeradius

Heap-buffer-overflow in fr_size_from_str

duckdb

Heap-use-after-free in duckdb::Planner::CreatePlan

c-blosc2

Heap-buffer-overflow in frame_get_vlmetalayers

hyper

Parser creates invalid uninitialized value

gfx-auxil

Reading on uninitialized buffer may cause UB ( `gfx_auxil::read_spirv()` )

linux

linux vulnerabilities

flumedb

`Read` on uninitialized buffer may cause UB ( `read_entry()` )

flatbuffers

Generated code can read and write out of bounds in safe code

enum-map

enum_map macro can cause UB when `Enum` trait is incorrectly implemented

derive-com-impl

QueryInterface should call AddRef before returning pointer

dashmap

Unsoundness in `dashmap` references

csv-sniffer

`Read` on uninitialized memory may cause UB (fn preamble_skipcount())

crypto2

Non-aligned u32 read in Chacha20 encryption and decryption

crossbeam

`SegQueue` creates zero value of any type

crossbeam-queue

`SegQueue` creates zero value of any type

crossbeam-channel

Channel creates zero value of any type

columnar

columnar: `Read` on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())

chrono

Potential segfault in `localtime_r` invocations

buffoon

InputStream::read_exact : `Read` on uninitialized buffer causes UB

bronzedb-protocol

`Read` on uninitialized buffer can cause UB (impl of `ReadKVExt`)

bite

`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)

binjs_io

'Read' on uninitialized memory may cause UB

arrow2, arrow2, arrow2

Arrow2 allows double free in `safe` code

arrow

`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets

arrow

`DecimalArray` does not perform bound checks on accessing values and offsets

ash

Reading on uninitialized memory may cause UB ( `util::read_spv()` )

arrow

`BinaryArray` does not perform bound checks on reading values and offsets

array-macro

`array!` macro is unsound when its length is impure constant

array-macro

`array!` macro is unsound in presence of traits that implement methods it calls internally

ammonia

Space bug in `clean_text`

acc_reader

`Read` on uninitialized buffer in `fill_buf()` and `read_up_to()`

abomonation

abomonation transmutes &T to and from &[u8] without sufficient constraints

electron, electron, electron, electron

AutoUpdater module fails to validate certain nested components of the bundle