deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-45715
Published: 2021-12-26
Description: An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md; https://rustsec.org/advisories/RUSTSEC-2021-0128.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md
CVE: CVE-2021-45716
Published: 2021-12-26
Description: An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md; https://rustsec.org/advisories/RUSTSEC-2021-0128.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md
CVE: CVE-2021-45717
Published: 2021-12-26
Description: An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md; https://rustsec.org/advisories/RUSTSEC-2021-0128.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md
CVE: CVE-2021-45718
Published: 2021-12-26
Description: An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md; https://rustsec.org/advisories/RUSTSEC-2021-0128.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md
CVE: CVE-2021-45719
Published: 2021-12-26
Description: An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md; https://rustsec.org/advisories/RUSTSEC-2021-0128.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md
CVE: CVE-2021-45720
Published: 2021-12-26
Description: An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lru/RUSTSEC-2021-0130.md; https://rustsec.org/advisories/RUSTSEC-2021-0130.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lru/RUSTSEC-2021-0130.md
CVE: CVE-2018-25023
Published: 2021-12-27
Description: An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://github.com/servo/rust-smallvec/commit/e64afc8c473d43e375ab42bd33db2d0d4ac4e41b; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/smallvec/RUSTSEC-2018-0018.md; https://rustsec.org/advisories/RUSTSEC-2018-0018.html
CVE: CVE-2018-25024
Published: 2021-12-27
Description: An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md; https://rustsec.org/advisories/RUSTSEC-2018-0019.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md
CVE: CVE-2018-25025
Published: 2021-12-27
Description: An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md; https://rustsec.org/advisories/RUSTSEC-2018-0019.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md
CVE: CVE-2018-25026
Published: 2021-12-27
Description: An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md; https://rustsec.org/advisories/RUSTSEC-2018-0019.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md
CVE: CVE-2018-25027
Published: 2021-12-27
Description: An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2018-0021.md; https://rustsec.org/advisories/RUSTSEC-2018-0021.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2018-0021.md
CVE: CVE-2018-25028
Published: 2021-12-27
Description: An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2018-0021.md; https://rustsec.org/advisories/RUSTSEC-2018-0021.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2018-0021.md
CVE: CVE-2019-25054
Published: 2021-12-27
Description: An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/pnet/RUSTSEC-2019-0037.md; https://rustsec.org/advisories/RUSTSEC-2019-0037.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/pnet/RUSTSEC-2019-0037.md
CVE: CVE-2019-25055
Published: 2021-12-27
Description: An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
CVSS Score: 7.5 (HIGH)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2019-0038.md; https://rustsec.org/advisories/RUSTSEC-2019-0038.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2019-0038.md
CVE: CVE-2020-36511
Published: 2021-12-27
Description: An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bite/RUSTSEC-2020-0153.md; https://rustsec.org/advisories/RUSTSEC-2020-0153.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bite/RUSTSEC-2020-0153.md
CVE: CVE-2020-36512
Published: 2021-12-27
Description: An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/buffoon/RUSTSEC-2020-0154.md; https://rustsec.org/advisories/RUSTSEC-2020-0154.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/buffoon/RUSTSEC-2020-0154.md
CVE: CVE-2020-36513
Published: 2021-12-27
Description: An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md; https://rustsec.org/advisories/RUSTSEC-2020-0155.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md
CVE: CVE-2020-36514
Published: 2021-12-27
Description: An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md; https://rustsec.org/advisories/RUSTSEC-2020-0155.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md
CVE: CVE-2021-45680
Published: 2021-12-27
Description: An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/vec-const/RUSTSEC-2021-0082.md; https://rustsec.org/advisories/RUSTSEC-2021-0082.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/vec-const/RUSTSEC-2021-0082.md
CVE: CVE-2021-45681
Published: 2021-12-27
Description: An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/derive-com-impl/RUSTSEC-2021-0083.md; https://rustsec.org/advisories/RUSTSEC-2021-0083.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/derive-com-impl/RUSTSEC-2021-0083.md
CVE: CVE-2021-45682
Published: 2021-12-27
Description: An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bronzedb-protocol/RUSTSEC-2021-0084.md; https://rustsec.org/advisories/RUSTSEC-2021-0084.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bronzedb-protocol/RUSTSEC-2021-0084.md
CVE: CVE-2021-45683
Published: 2021-12-27
Description: An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/binjs_io/RUSTSEC-2021-0085.md; https://rustsec.org/advisories/RUSTSEC-2021-0085.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/binjs_io/RUSTSEC-2021-0085.md
CVE: CVE-2021-45684
Published: 2021-12-27
Description: An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/flumedb/RUSTSEC-2021-0086.md; https://rustsec.org/advisories/RUSTSEC-2021-0086.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/flumedb/RUSTSEC-2021-0086.md
CVE: CVE-2021-45685
Published: 2021-12-27
Description: An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/columnar/RUSTSEC-2021-0087.md; https://rustsec.org/advisories/RUSTSEC-2021-0087.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/columnar/RUSTSEC-2021-0087.md
CVE: CVE-2021-45686
Published: 2021-12-27
Description: An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/csv-sniffer/RUSTSEC-2021-0088.md; https://rustsec.org/advisories/RUSTSEC-2021-0088.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/csv-sniffer/RUSTSEC-2021-0088.md
CVE: CVE-2021-45687
Published: 2021-12-27
Description: An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/raw-cpuid/RUSTSEC-2021-0089.md; https://rustsec.org/advisories/RUSTSEC-2021-0089.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/raw-cpuid/RUSTSEC-2021-0089.md
CVE: CVE-2021-45688
Published: 2021-12-27
Description: An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ash/RUSTSEC-2021-0090.md; https://rustsec.org/advisories/RUSTSEC-2021-0090.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ash/RUSTSEC-2021-0090.md
CVE: CVE-2021-45689
Published: 2021-12-27
Description: An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/gfx-auxil/RUSTSEC-2021-0091.md; https://rustsec.org/advisories/RUSTSEC-2021-0091.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/gfx-auxil/RUSTSEC-2021-0091.md
CVE: CVE-2021-45690
Published: 2021-12-27
Description: An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md; https://rustsec.org/advisories/RUSTSEC-2021-0092.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md
CVE: CVE-2021-45691
Published: 2021-12-27
Description: An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md; https://rustsec.org/advisories/RUSTSEC-2021-0092.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md
CVE: CVE-2021-45692
Published: 2021-12-27
Description: An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md; https://rustsec.org/advisories/RUSTSEC-2021-0092.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md
CVE: CVE-2021-45693
Published: 2021-12-27
Description: An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md; https://rustsec.org/advisories/RUSTSEC-2021-0092.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md
CVE: CVE-2021-45694
Published: 2021-12-27
Description: An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rdiff/RUSTSEC-2021-0094.md; https://rustsec.org/advisories/RUSTSEC-2021-0094.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rdiff/RUSTSEC-2021-0094.md
CVE: CVE-2021-45695
Published: 2021-12-27
Description: An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
CVSS Score: 9.8 (CRITICAL)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/mopa/RUSTSEC-2021-0095.md; https://rustsec.org/advisories/RUSTSEC-2021-0095.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/mopa/RUSTSEC-2021-0095.md
CVE: CVE-2021-45696
Published: 2021-12-27
Description: An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/sha2/RUSTSEC-2021-0100.md; https://rustsec.org/advisories/RUSTSEC-2021-0100.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/sha2/RUSTSEC-2021-0100.md
CVE: CVE-2021-45697
Published: 2021-12-27
Description: An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
CVSS Score: 9.8 (CRITICAL)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md; https://rustsec.org/advisories/RUSTSEC-2021-0103.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md
CVE: CVE-2021-45698
Published: 2021-12-27
Description: An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
CVSS Score: 9.8 (CRITICAL)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ckb/RUSTSEC-2021-0107.md; https://rustsec.org/advisories/RUSTSEC-2021-0107.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ckb/RUSTSEC-2021-0107.md
CVE: CVE-2021-45699
Published: 2021-12-27
Description: An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ckb/RUSTSEC-2021-0108.md; https://rustsec.org/advisories/RUSTSEC-2021-0108.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ckb/RUSTSEC-2021-0108.md
CVE: CVE-2021-45700
Published: 2021-12-27
Description: An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
CVSS Score: 7.5 (HIGH)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ckb/RUSTSEC-2021-0109.md; https://rustsec.org/advisories/RUSTSEC-2021-0109.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ckb/RUSTSEC-2021-0109.md
CVE: CVE-2021-45701
Published: 2021-12-27
Description: An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tremor-script/RUSTSEC-2021-0111.md; https://rustsec.org/advisories/RUSTSEC-2021-0111.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tremor-script/RUSTSEC-2021-0111.md
CVE: CVE-2021-45702
Published: 2021-12-27
Description: An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tremor-script/RUSTSEC-2021-0111.md; https://rustsec.org/advisories/RUSTSEC-2021-0111.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tremor-script/RUSTSEC-2021-0111.md
CVE: CVE-2021-45703
Published: 2021-12-27
Description: An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tectonic_xdv/RUSTSEC-2021-0112.md; https://rustsec.org/advisories/RUSTSEC-2021-0112.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tectonic_xdv/RUSTSEC-2021-0112.md
CVE: CVE-2021-45704
Published: 2021-12-27
Description: An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-787
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/metrics-util/RUSTSEC-2021-0113.md; https://rustsec.org/advisories/RUSTSEC-2021-0113.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/metrics-util/RUSTSEC-2021-0113.md
CVE: CVE-2021-45705
Published: 2021-12-27
Description: An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
CVSS Score: 9.8 (CRITICAL)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nanorand/RUSTSEC-2021-0114.md; https://rustsec.org/advisories/RUSTSEC-2021-0114.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nanorand/RUSTSEC-2021-0114.md
CVE: CVE-2021-45706
Published: 2021-12-27
Description: An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-459
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/zeroize_derive/RUSTSEC-2021-0115.md; https://rustsec.org/advisories/RUSTSEC-2021-0115.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/zeroize_derive/RUSTSEC-2021-0115.md
CVE: CVE-2021-45707
Published: 2021-12-27
Description: An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/advisories/GHSA-wgrg-5h56-jg27; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.md; https://rustsec.org/advisories/RUSTSEC-2021-0119.html
CVE: CVE-2021-45708
Published: 2021-12-27
Description: An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abomonation/RUSTSEC-2021-0120.md; https://rustsec.org/advisories/RUSTSEC-2021-0120.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abomonation/RUSTSEC-2021-0120.md