This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate cursive

Dependencies

(17 total, 5 outdated, 2 insecure)

CrateRequiredLatestStatus
 ahash^0.80.8.12up to date
 bear-lib-terminal^22.0.0up to date
 cfg-if^11.0.1up to date
 crossbeam-channel^0.50.5.15up to date
 crossterm^0.250.29.0out of date
 cursive_core^0.3.00.4.6out of date
 lazy_static^11.5.0up to date
 libc^0.20.2.174up to date
 log^0.40.4.27up to date
 maplit^1.01.0.2up to date
 ncurses ⚠️^5.99.06.0.1insecure
 pancurses ⚠️^0.170.17.0insecure
 signal-hook^0.30.3.18up to date
 term_size^0.30.3.2up to date
 termion^14.0.5out of date
 unicode-segmentation^11.12.0up to date
 unicode-width^0.10.2.1out of date

Dev dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 atty^0.20.2.14up to date
 pretty-bytes^0.20.2.2up to date
 rand^0.80.9.1out of date

Security Vulnerabilities

pancurses: Format string vulnerabilities in `pancurses`

RUSTSEC-2019-0005

pancurses::mvprintw and pancurses::printw passes a pointer from a rust &str to C, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory.

ncurses: Buffer overflow and format vulnerabilities in functions exposed without unsafe

RUSTSEC-2019-0006

ncurses exposes functions from the ncurses library which:

  • Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (instr, mvwinstr, etc)
  • Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the printw family).