https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 12:24:34 +0000 https://cve.radiocsirt.org/vuln/rustsec-2025-0016 <p><strong>Affected:</strong> crates.io: pared</p> <p>Affected versions of this crate didn&#39;t provide sufficient lifetime constraints to conversion functions from `alloc::sync::Arc` and `alloc::rc::Rc`, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data&#39;s lifetimes.</p> <p>This projected pointer could cause the original `Arc`&#39;s or `Rc`&#39;s `Drop::drop` to get called at a point where the original data was no longer valid, leading to a potential use after free.</p> <p>The affected functions were - `pared::prc::Prc::from_rc` - `pared::prc::Prc::project` - `pared::prc::Prc::try_from_rc` - `pared::sync::Parc::from_arc` - `pared::sync::Parc::project` - `pared::sync::Parc::try_from_arc`</p> <p>This flaw was fixed in [108f540ea8acb6073751a1aa386085c1cdc4fd1e](https://github.com/radekvit/pared/commit/108f540ea8acb6073751a1aa386085c1cdc4fd1e) by requiring that the type stored in the `Arc`s and `Rc`s passed to these functions contain `T: &#39;static`.</p> <p><strong>Affected:</strong> crates.io: pared</p> <p>Affected versions of this crate didn&#39;t provide sufficient lifetime constraints to conversion functions from `alloc::sync::Arc` and `alloc::rc::Rc`, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data&#39;s lifetimes.</p> <p>This projected pointer could cause the original `Arc`&#39;s or `Rc`&#39;s `Drop::drop` to get called at a point where the original data was no longer valid, leading to a potential use after free.</p> <p>The affected functions were - `pared::prc::Prc::from_rc` - `pared::prc::Prc::project` - `pared::prc::Prc::try_from_rc` - `pared::sync::Parc::from_arc` - `pared::sync::Parc::project` - `pared::sync::Parc::try_from_arc`</p> <p>This flaw was fixed in [108f540ea8acb6073751a1aa386085c1cdc4fd1e](https://github.com/radekvit/pared/commit/108f540ea8acb6073751a1aa386085c1cdc4fd1e) by requiring that the type stored in the `Arc`s and `Rc`s passed to these functions contain `T: &#39;static`.</p> https://cve.radiocsirt.org/vuln/rustsec-2025-0016