p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in rustc

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für rustc: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 12

  1. CVE-2022-23639

    Hoch · CVSS 8.1EPSS 1,23%Korrektur verfügbar

    Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils

    crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are curre

    rustcBetriebssysteme
    • Auf 1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2022-21658

    Hoch · CVSS 7.3EPSS 1,38%Korrektur verfügbar

    Race condition in std::fs::remove_dir_all in rustlang

    Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack,

    rustcBetriebssysteme
    • Auf 1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2021-42574

    Hoch · CVSS 8.3EPSS 12,88%Korrektur verfügbar

    CVE-2021-42574

    An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect appli

    rustcBetriebssysteme
    • Auf 1.57.0+dfsg1+llvm-0ubuntu1~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2021-29922

    Kritisch · CVSS 9.1EPSS 2,62%Korrektur verfügbar

    CVE-2021-29922

    library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

    rustcBetriebssysteme
    • Auf 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2020-36323

    Hoch · CVSS 8.2EPSS 2,02%Korrektur verfügbar

    CVE-2020-36323

    In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

    rustcBetriebssysteme
    • Auf 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2020-36317

    Hoch · CVSS 7.5EPSS 1,5%Korrektur verfügbar

    CVE-2020-36317

    In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.

    rustcBetriebssysteme
    • Auf 1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2021-28878

    Hoch · CVSS 7.5EPSS 2%Korrektur verfügbar

    CVE-2021-28878

    In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    rustcBetriebssysteme
    • Auf 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2021-28877

    Hoch · CVSS 7.5EPSS 1,39%Korrektur verfügbar

    CVE-2021-28877

    In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    rustcBetriebssysteme
    • Auf 1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2021-28876

    Mittel · CVSS 5.3EPSS 1,57%Korrektur verfügbar

    CVE-2021-28876

    In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    rustcBetriebssysteme
    • Auf 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →