Rust-lang Rust
24 CVEs affecting Rust-lang Rust. Latest disclosed: 2024-09-04. Critical: 7, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24576 | Critical | 10.0 | 2024-04-09 | Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape argum… |
CVE-2024-3566 | Critical | 9.8 | 2024-04-10 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function whe… |
CVE-2021-31162 | Critical | 9.8 | 2021-04-14 | In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. |
CVE-2021-28879 | Critical | 9.8 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer ov… |
CVE-2020-36318 | Critical | 9.8 | 2021-04-11 | In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug… |
CVE-2018-1000810 | Critical | 9.8 | 2018-10-08 | The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffe… |
CVE-2021-29922 | Critical | 9.1 | 2021-08-07 | library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in s… |
CVE-2020-36323 | High | 8.2 | 2021-04-14 | In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to… |
CVE-2024-43402 | High | 8.1 | 2024-09-04 | Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, w… |
CVE-2019-12083 | High | 8.1 | 2019-05-13 | The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and… |
CVE-2018-1000657 | High | 7.8 | 2018-08-20 | Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Bu… |
CVE-2018-1000622 | High | 7.8 | 2018-07-09 | The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that… |
CVE-2021-28878 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditi… |
CVE-2021-28877 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug… |
CVE-2021-28875 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer… |
CVE-2020-36317 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the pro… |
CVE-2015-20001 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic ele… |
CVE-2022-21658 | High | 7.3 | 2022-01-20 | Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG… |
CVE-2023-40030 | Medium | 6.1 | 2023-08-24 | Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names whe… |
CVE-2018-25008 | Medium | 5.9 | 2021-04-14 | In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safet… |