Most recent entries from all

EUVD-2026-248510

fkie_cve-2023-53159

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

GHSA-xcf7-rvmh-g6q4 — `openssl` `X509VerifyParamRef::set_host` buffer over-read

Affected: crates.io: openssl

When this function was passed an empty string, `openssl` would attempt to call `strlen` on it, reading arbitrary memory until it reached a NUL byte.

msrc_CVE-2023-53159 — The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_h…

msrc_CVE-2023-53159

OESA-2026-2944 — rpm-ostree security update

Affected: openEuler:22.03-LTS-SP4: rpm-ostree

rpm-ostree is a hybrid image/package system. It supports &quot;composing&quot; packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many &quot;pure&quot; image systems, with rpm-ostree each client system can layer on additional packages, providing a &quot;best of both worlds&quot; approach. Security Fix(es):

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.(CVE-2023-53159)

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.(CVE-2024-12224)

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.(CVE-2025-3416)

RUSTSEC-2023-0044 — `openssl` `X509VerifyParamRef::set_host` buffer over-read

Affected: crates.io: openssl

When this function was passed an empty string, `openssl` would attempt to call `strlen` on it, reading arbitrary memory until it reached a NUL byte.

UBUNTU-CVE-2023-53159

Affected: Ubuntu:Pro:20.04:LTS: rust-openssl, Ubuntu:Pro:22.04:LTS: rust-openssl

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.