Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-25575An issue was discovered in the failure crate through 0.1.5 for Rust.crates.io · failure
- CVE-2020-25016A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or dcrates.io · rgb · fixed in 0.8.20
- CVE-2020-15899Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.crates.io · grin · fixed in 4.0.0
- CVE-2020-15093Improper verification of signature threshold in toughcrates.io · tough · fixed in 0.7.1
- CVE-2020-13759rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obcrates.io · vm-memory · fixed in 0.1.1, 0.2.1
- CVE-2020-12439Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.crates.io · grin · fixed in 3.1.0
- CVE-2020-1967Segmentation fault in SSL_check_chaincrates.io · openssl-src · fixed in 111.9.0
- CVE-2019-20399A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak crates.io · libsecp256k1-rs · fixed in 0.3.1
- CVE-2020-6638Grin through 2.1.1 has Insufficient Validation.crates.io · grin · fixed in 3.0.0
- CVE-2019-16760Cargo prior to Rust 1.26.0 may download the wrong dependencycrates.io · cargo · fixed in 0.27.0
- CVE-2019-16882An issue was discovered in the string-interner crate before 0.7.1 for Rust.crates.io · string-interner · fixed in 0.6.4, 0.7.1
- CVE-2019-16881An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust.crates.io · portaudio-rs · fixed in 0.3.2, 0.3.2-0
- CVE-2019-16880An issue was discovered in the linea crate through 0.9.4 for Rust.crates.io · linea · fixed in 0.9.4, 0.9.5-0
- CVE-2019-16144An issue was discovered in the generator crate before 0.6.18 for Rust.crates.io · generator · fixed in 0.6.18
- CVE-2019-16143An issue was discovered in the blake2 crate before 0.8.1 for Rust.crates.io · blake2 · fixed in 0.8.1
- CVE-2019-16142An issue was discovered in the renderdoc crate before 0.5.0 for Rust.crates.io · renderdoc · fixed in 0.5.0
- CVE-2019-16141An issue was discovered in the once_cell crate before 1.0.1 for Rust.crates.io · once_cell · fixed in 1.0.1
- CVE-2019-16139An issue was discovered in the compact_arena crate before 0.4.0 for Rust.crates.io · compact_arena · fixed in 0.4.0
- CVE-2019-16138An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder.crates.io · image · fixed in 0.21.3
- CVE-2019-16137An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used.crates.io · spin · fixed in 0.5.2
- CVE-2019-16140An issue was discovered in the chttp crate before 0.1.3 for Rust.crates.io · chttp · fixed in 0.1.3
- CVE-2017-18588An issue was discovered in the security-framework crate before 0.1.12 for Rust.crates.io · security-framework · fixed in 0.1.12
- CVE-2018-20989An issue was discovered in the untrusted crate before 0.6.2 for Rust.crates.io · untrusted · fixed in 0.6.2
- CVE-2017-18589An issue was discovered in the cookie crate before 0.7.6 for Rust.crates.io · cookie · fixed in 0.7.6, 0.6.2
- CVE-2018-20995An issue was discovered in the slice-deque crate before 0.1.16 for Rust.crates.io · slice-deque · fixed in 0.1.16
- CVE-2018-20996An issue was discovered in the crossbeam crate before 0.4.1 for Rust.crates.io · crossbeam · fixed in 0.4.1
- CVE-2018-20997An issue was discovered in the openssl crate before 0.10.9 for Rust.crates.io · openssl · fixed in 0.10.9
- CVE-2018-20998An issue was discovered in the arrayfire crate before 3.6.0 for Rust.crates.io · arrayfire · fixed in 3.6.0
- CVE-2019-15542An issue was discovered in the ammonia crate before 2.1.0 for Rust.crates.io · ammonia · fixed in 2.1.0
- CVE-2019-15543An issue was discovered in the slice-deque crate before 0.2.0 for Rust.crates.io · slice-deque · fixed in 0.2.0