Mishandling of format strings in rusqlite
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
01
beschreibt (8)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-35873US | critical9.8 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free. | ||||
| CVE-2020-35872US | critical9.8 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type. | ||||
| CVE-2020-35871US | high8.1 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race. | ||||
| CVE-2020-35870US | critical9.8 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free. | ||||
| CVE-2020-35869US | critical9.8 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings. | ||||
| CVE-2020-35868US | critical9.8 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification. | ||||
| CVE-2020-35867US | critical9.8 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module. | ||||
| CVE-2020-35866US | critical9.8 | — | ||
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/rusqlite/rusqlitePACKAGE
- https://github.com/rusqlite/rusqlite/commit/2327d3b774927fdf48903c0bdc1ca7ec93c7c8d0WEB
- https://github.com/rusqlite/rusqlite/releases/tag/0.23.0WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-35869ADVISORY
- https://rustsec.org/advisories/RUSTSEC-2020-0014.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan