Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-20001PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
CVE-2020-36318PUBLISHED: 2021-04-11In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2021-28875PUBLISHED: 2021-04-11In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876PUBLISHED: 2021-04-11
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety r...
0 Comments
Tweet This
User Rank: Guru
3/31/2015 | 7:18:34 PM
It's either: 1) Management is not competent. Some managers are like "what are you doing? You're not doing anything productive. We don't see any result. We are wasting money." 2) Then there are incompetent security experts who are faking security. They are not doing aything + keeps making things up and pointing fingers.
Security is trying to find out the holes, try to break, try to exploit the system. Most of the time is trying to break the system and then finding the solution. How do you know they are lying, playing or working without a total understanding of the computer security?