Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
16 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The lifetime bound on several closure-accepting rusqlite functions (specifically, functions which register a callback to be later invoked by SQLite) was too relaxed. If a closure referencing borrowed values on the stack is was passed to one of these functions, it could allow Rust code to access objects on the stack after they have been dropped. The impacted functions are: - Under cfg(feature = "functions"): Connection::createscalarfunction, Connection::createaggregatefunction and Connection::createwindowfunction. - Under cfg(feature = "hooks"): Connection::commithook, Connection::rollbackhook and Connection::updatehook. - Under cfg(feature = "collation"): Connection::createcollation. The issue exists in all 0.25. versions prior to 0.25.4, and all 0.26. versions prior to 0.26.2 (specifically: 0.25.0, 0.25.1, 0.25.2, 0.25.3, 0.26.0, and 0.26.1). The fix is available in versions 0.26.2 and newer, and also has been back-ported to 0.25.4. As it does not exist in 0.24., all affected…
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. createcollation has a use-after-free.
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. createscalarfunction has a use-after-free.
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. createaggregatefunction has a use-after-free.
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollbackhook has a use-after-free.
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commithook has a use-after-free.
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. createwindowfunction has a use-after-free.
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. updatehook has a use-after-free.
Recommended action: Upgrade to 0.26.2 or 0.25.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via createmodule.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.