Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

zstd-safe

12 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12
Registry
crates.io

Advisories 12

  • Use-after-free when changing a multithreaded context with an unfinished frame

    Affected: fixed in 8.2.0.

  • Out-of-bounds read with an out-of-range `InBuffer::pos`

    Affected: from 7.2.2, fixed in 8.2.0.

  • Double free in `DCtx::try_clone`

    Affected: from 4.1.4, fixed in 8.2.0.

  • Uninitialized memory exposed when streaming decompression of a legacy frame fails

    Affected: from 4.0.0, fixed in 7.4.0; from 8.0.0-0, fixed in 8.2.0.

  • Heap buffer overflow in `CCtx::try_clone` on a multithreaded context

    Affected: from 4.1.4, fixed in 8.2.0.

  • Out-of-bounds read in `train_from_buffer` when sample sizes overflow

    Affected: fixed in 8.2.0.

  • Use-after-free of a dictionary after a one-shot call on a context with an open stream

    Affected: from 3.0.1, fixed in 8.2.0.

  • Use-after-free through `init_using_cdict` and `init_using_ddict`

    Affected: from 3.0.0, fixed in 8.2.0.

  • `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

    Affected: from 7.2.2, fixed in 8.2.0.

  • `OutBuffer::around_pos` exposes uninitialized memory

    Affected: from 4.0.0, fixed in 8.2.0.

  • `Seekable` reads a NULL or out-of-bounds seek table

    Affected: from 7.2.2, fixed in 8.2.0.

  • Use-after-free with `CParameter::StableInBuffer`

    Affected: from 4.1.0, fixed in 8.2.0.