Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-36008Message length overflow in frontiercrates.io · fc-rpc
- CVE-2022-36125Integer overflow when reading corrupted .avro file in Avro Rust SDKcrates.io · apache-avro · fixed in 0.14.0
- CVE-2022-36124Memory overconsumption in Avro Rust SDKcrates.io · apache-avro · fixed in 0.14.0
- CVE-2022-35724Denial of service while reading data in Avro Rust SDKcrates.io · apache-avro · fixed in 0.14.0
- CVE-2022-35737SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to acrates.io · libsqlite3-sys · fixed in 0.25.1
- CVE-2022-35922Memory allocation based on untrusted length in rust-websocketcrates.io · websocket · fixed in 0.26.5
- CVE-2022-31173Juniper is vulnerable to @DOS GraphQL Nested Fragments overflowcrates.io · juniper · fixed in 0.15.10
- CVE-2022-34529WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.crates.io · wasm3
- CVE-2022-31169Cranelift vulnerable to miscompilation of constant values in division on AArch64crates.io · cranelift-codegen, wasmtime · fixed in 0.85.2, 0.38.2, 0.34.1 and more
- CVE-2022-31162Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logscrates.io · slack-morphism · fixed in 0.41.0
- CVE-2022-31146Use After Free in Wasmtimecrates.io · cranelift-codegen, wasmtime · fixed in 0.85.2, 0.38.2
- CVE-2022-2097AES OCB fails to encrypt some bytescrates.io · openssl-src · fixed in 111.22.0, 300.0.9
- CVE-2022-2274RSA implementation bug in AVX512IFMA instructionscrates.io · openssl-src · fixed in 300.0.9
- CVE-2022-31104Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtimecrates.io · cranelift-codegen, wasmtime · fixed in 0.85.1, 0.38.1
- CVE-2022-31099Uncontrolled Recursion in rulexcrates.io · rulex · fixed in 0.4.3
- CVE-2022-31100Reachable Assertion in rulexcrates.io · rulex · fixed in 0.4.3
- CVE-2022-31053Signature forgery in Biscuitcrates.io · biscuit-auth · fixed in 2.0.0
- CVE-2021-41641Deno <=1.14.0 file sandbox does not handle symbolic links correctly.crates.io · deno · fixed in 1.16.0
- CVE-2022-31264Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers.crates.io · solana_rbpf · fixed in 0.2.29
- CVE-2022-29185Observable Timing Discrepancy in totp-rscrates.io · totp-rs · fixed in 1.1.0
- CVE-2022-23066Solana rBPF - Incorrect Calculation in sdiv instructioncrates.io · solana_rbpf · fixed in 0.2.28
- CVE-2022-1473Resource leakage when decoding certificates and keyscrates.io · openssl-src · fixed in 300.0.6
- CVE-2022-1434Incorrect MAC key used in the RC4-MD5 ciphersuitecrates.io · openssl-src · fixed in 300.0.6
- CVE-2022-1343OCSP_basic_verify may incorrectly verify the response signing certificatecrates.io · openssl-src · fixed in 300.0.6
- CVE-2022-27817SWHKD 1.1.5 consumes the keyboard events of unintended users.crates.io · simple-wayland-hotkey-daemon
- CVE-2022-27814SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.crates.io · simple-wayland-hotkey-daemon · fixed in 1.2.0
- CVE-2022-27818SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname.crates.io · simple-wayland-hotkey-daemon · fixed in 1.2.0
- CVE-2022-27819SWHKD 1.1.5 allows unsafe parsing via the -c option.crates.io · simple-wayland-hotkey-daemon · fixed in 1.2.0
- CVE-2022-24791Use after free in Wasmtimecrates.io · wasmtime · fixed in 0.34.2, 0.35.2
- CVE-2022-27816SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname.crates.io · simple-wayland-hotkey-daemon · fixed in 1.2.0