https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:31:21 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-05387 bdu:2020-05387 https://cve.radiocsirt.org/vuln/bdu:2020-05387 https://cve.radiocsirt.org/vuln/certfr-2020-avi-660 certfr-2020-avi-660 https://cve.radiocsirt.org/vuln/certfr-2020-avi-660 https://cve.radiocsirt.org/vuln/cnvd-2020-58037 cnvd-2020-58037 https://cve.radiocsirt.org/vuln/cnvd-2020-58037 https://cve.radiocsirt.org/vuln/euvd-2026-42788 EUVD-2026-42788 https://cve.radiocsirt.org/vuln/euvd-2026-42788 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15254 <p>Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.</p> <p>Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-15254 https://cve.radiocsirt.org/vuln/ghsa-v5m7-53cv-f3hx <p><strong>Affected:</strong> crates.io: crossbeam-channel</p> <p>### Impact</p> <p>The affected version of this crate&#39;s the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.</p> <p>### Patches</p> <p>This has been fixed in crossbeam-channel 0.4.4.</p> <p>We recommend users to upgrade to 0.4.4.</p> <p>### References</p> <p>See https://github.com/crossbeam-rs/crossbeam/pull/533, https://github.com/crossbeam-rs/crossbeam/issues/539, and https://github.com/RustSec/advisory-db/pull/425 for more details.</p> <p>### License</p> <p>This advisory is in the public domain.</p> <p><strong>Affected:</strong> crates.io: crossbeam-channel</p> <p>### Impact</p> <p>The affected version of this crate&#39;s the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.</p> <p>### Patches</p> <p>This has been fixed in crossbeam-channel 0.4.4.</p> <p>We recommend users to upgrade to 0.4.4.</p> <p>### References</p> <p>See https://github.com/crossbeam-rs/crossbeam/pull/533, https://github.com/crossbeam-rs/crossbeam/issues/539, and https://github.com/RustSec/advisory-db/pull/425 for more details.</p> <p>### License</p> <p>This advisory is in the public domain.</p> https://cve.radiocsirt.org/vuln/ghsa-v5m7-53cv-f3hx https://cve.radiocsirt.org/vuln/gsd-2020-15254 gsd-2020-15254 https://cve.radiocsirt.org/vuln/gsd-2020-15254 https://cve.radiocsirt.org/vuln/msrc_cve-2020-15254 msrc_CVE-2020-15254 https://cve.radiocsirt.org/vuln/msrc_cve-2020-15254 https://cve.radiocsirt.org/vuln/opensuse-su-2024:10600-1 <p>MozillaFirefox-92.0-1.2 on GA media</p> <p>MozillaFirefox-92.0-1.2 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:10600-1 https://cve.radiocsirt.org/vuln/rustsec-2020-0052 <p><strong>Affected:</strong> crates.io: crossbeam-channel</p> <p>The affected version of this crate&#39;s the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.</p> <p><strong>Affected:</strong> crates.io: crossbeam-channel</p> <p>The affected version of this crate&#39;s the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.</p> https://cve.radiocsirt.org/vuln/rustsec-2020-0052 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15254 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: firefox, Ubuntu:18.04:LTS: firefox, Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:20.04:LTS: rust-crossbeam, Ubuntu:22.04:LTS: rust-crossbeam, Ubuntu:24.04:LTS: rust-crossbeam and 2 more</p> <p>Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: firefox, Ubuntu:18.04:LTS: firefox, Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:20.04:LTS: rust-crossbeam, Ubuntu:22.04:LTS: rust-crossbeam, Ubuntu:24.04:LTS: rust-crossbeam and 2 more</p> <p>Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15254