rustc - Debian Package Tracker

general

source: rustc (main)
version: 1.50.0+dfsg1-1
maintainer: Debian Rust Maintainers (archive) (DMD)
uploaders: Sylvestre Ledru [DMD] – Ximin Luo [DMD]
arch: all any
std-ver: 4.2.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.34.2+dfsg1-1~deb9u1
o-o-sec: 1.41.1+dfsg1-1~deb9u1
oldstable: 1.41.1+dfsg1-1~deb10u1
stable: 1.48.0+dfsg1-2
testing: 1.49.0+dfsg1-1
unstable: 1.50.0+dfsg1-1
exp: 1.52.1+dfsg1-1~exp3
NEW/unstable: 1.51.0+dfsg1-1

versioned links

1.34.2+dfsg1-1~deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.34.2+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.41.1+dfsg1-1~deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.41.1+dfsg1-1~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.48.0+dfsg1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.49.0+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.50.0+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.52.1+dfsg1-1~exp3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libstd-rust-1.50
libstd-rust-dev
libstd-rust-dev-wasm32
libstd-rust-dev-windows
rust-doc (5 bugs: 1, 2, 2, 0)
rust-gdb
rust-lldb (1 bugs: 1, 0, 0, 0)
rust-src (1 bugs: 0, 1, 0, 0)
rustc (10 bugs: 1, 8, 1, 0)

action needed

A new upstream version is available: 1.55.0 high

A new upstream version 1.55.0 is available, you should consider packaging it.

Created: 2021-03-02 Last update: 2021-09-21 05:36

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2020-12-23 Last update: 2021-09-20 22:04

10 security issues in sid high

There are 10 open security issues in sid.

10 important issues:

CVE-2020-36317: In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVE-2020-36318: In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2020-36323: In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
CVE-2021-28875: In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876: In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28877: In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28878: In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28879: In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
CVE-2021-29922: library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
CVE-2021-31162: In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.

Created: 2021-04-12 Last update: 2021-09-19 18:30

10 security issues in bookworm high

There are 10 open security issues in bookworm.

10 important issues:

CVE-2020-36317: In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVE-2020-36318: In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2020-36323: In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
CVE-2021-28875: In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876: In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28877: In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28878: In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28879: In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
CVE-2021-29922: library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
CVE-2021-31162: In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.

Created: 2021-08-15 Last update: 2021-09-19 18:30

lintian reports 3 errors and 18 warnings high

Lintian reports 3 errors and 18 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-09-21 Last update: 2021-09-06 18:35

2 bugs tagged help in the BTS normal

The BTS contains 2 bugs tagged help, please consider helping the maintainer in dealing with them.

Created: 2020-12-10 Last update: 2021-09-21 05:32

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2021-08-14 Last update: 2021-09-21 05:32

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-12-28 Last update: 2021-09-21 02:01

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

rust-src could be marked Multi-Arch: foreign

Created: 2017-01-10 Last update: 2021-09-21 02:02

10 low-priority security issues in buster low

There are 10 open security issues in buster.

10 issues left for the package maintainer to handle:

CVE-2020-36317: (needs triaging) In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVE-2020-36318: (needs triaging) In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2020-36323: (needs triaging) In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
CVE-2021-28875: (needs triaging) In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876: (needs triaging) In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28877: (needs triaging) In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28878: (needs triaging) In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28879: (needs triaging) In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
CVE-2021-29922: (needs triaging) library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
CVE-2021-31162: (needs triaging) In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-04-12 Last update: 2021-09-19 18:30

10 low-priority security issues in bullseye low

There are 10 open security issues in bullseye.

10 issues left for the package maintainer to handle:

CVE-2020-36317: (needs triaging) In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVE-2020-36318: (needs triaging) In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2020-36323: (needs triaging) In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
CVE-2021-28875: (needs triaging) In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876: (needs triaging) In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28877: (needs triaging) In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28878: (needs triaging) In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVE-2021-28879: (needs triaging) In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
CVE-2021-29922: (needs triaging) library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
CVE-2021-31162: (needs triaging) In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-08-14 Last update: 2021-09-19 18:30

Build log checks report 3 warnings low

Build log checks report 3 warnings

Created: 2020-12-21 Last update: 2021-09-06 18:07

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.0 instead of 4.2.1).

Created: 2018-12-23 Last update: 2021-09-19 20:36

testing migrations

excuses:
- Migrates after: glibc
- Migration status for rustc (1.49.0+dfsg1-1 to 1.50.0+dfsg1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- Not built on buildd: arch armel binaries uploaded by infinity0
- Too young, only 2 of 5 days old
- Depends: rustc glibc
- Additional info:
- Piuparts tested OK - https://piuparts.debian.org/sid/source/r/rustc.html
- Not considered

news

[rss feed]

[2021-09-19] Accepted rustc 1.50.0+dfsg1-1 (armel source) into unstable, unstable (Debian FTP Masters) (signed by: infinity0@debian.org)
[2021-09-18] Accepted rustc 1.49.0+dfsg1-2 (source) into unstable (Ximin Luo) (signed by: infinity0@debian.org)
[2021-09-08] rustc 1.49.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2021-09-03] Accepted rustc 1.49.0+dfsg1-1 (armhf source) into unstable, unstable (Debian FTP Masters) (signed by: infinity0@debian.org)
[2021-05-19] Accepted rustc 1.52.1+dfsg1-1~exp3 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-05-17] Accepted rustc 1.52.1+dfsg1-1~exp2 (armel source) into experimental, experimental (Debian FTP Masters) (signed by: infinity0@debian.org)
[2021-05-17] Accepted rustc 1.52.1+dfsg1-1~exp1 (armel source) into experimental, experimental (Debian FTP Masters) (signed by: infinity0@debian.org)
[2021-05-07] Accepted rustc 1.52.0+dfsg1-1~exp1 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-05-06] Accepted rustc 1.52.0~beta.3+dfsg1-1~exp4 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-05-05] Accepted rustc 1.52.0~beta.3+dfsg1-1~exp3 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-05-05] Accepted rustc 1.52.0~beta.3+dfsg1-1~exp2 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-05-04] Accepted rustc 1.52.0~beta.3+dfsg1-1~exp1 (armel source) into experimental, experimental (Debian FTP Masters) (signed by: infinity0@debian.org)
[2021-04-26] Accepted rustc 1.51.0+dfsg1-1~exp3 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-04-26] Accepted rustc 1.51.0+dfsg1-1~exp2 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-04-22] Accepted rustc 1.51.0+dfsg1-1~exp1 (armel source) into experimental, experimental (Debian FTP Masters) (signed by: infinity0@debian.org)
[2021-04-12] Accepted rustc 1.50.0+dfsg1-1~exp4 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-04-11] Accepted rustc 1.50.0+dfsg1-1~exp3 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-04-10] Accepted rustc 1.50.0+dfsg1-1~exp2 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2021-04-09] Accepted rustc 1.50.0+dfsg1-1~exp1 (armel source) into experimental, experimental (Debian FTP Masters) (signed by: infinity0@debian.org)
[2021-04-05] Accepted rustc 1.49.0+dfsg1-1~exp1 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)
[2020-12-26] rustc 1.48.0+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2020-12-26] rustc 1.48.0+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2020-12-22] Accepted rustc 1.49.0~beta.4+dfsg1-1~exp1 (armhf source) into experimental, experimental (Debian FTP Masters) (signed by: infinity0@debian.org)
[2020-12-20] Accepted rustc 1.48.0+dfsg1-2 (source) into unstable (Ximin Luo) (signed by: infinity0@debian.org)
[2020-12-07] rustc 1.48.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2020-12-01] Accepted rustc 1.48.0+dfsg1-1 (source) into unstable (Ximin Luo) (signed by: infinity0@debian.org)
[2020-12-01] Accepted rustc 1.48.0+dfsg1-1~exp1 (source) into unstable (Ximin Luo) (signed by: infinity0@debian.org)
[2020-11-17] rustc 1.47.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2020-11-17] rustc 1.47.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2020-11-13] Accepted rustc 1.48.0~beta.8+dfsg1-1~exp3 (source) into experimental (Ximin Luo) (signed by: infinity0@debian.org)

bugs [bug history graph]

all: 22 23
RC: 3
I&N: 14 15
M&W: 5
F&P: 0
patch: 2
help: 2

links

homepage
lintian (3, 18)
buildd: logs, exp, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.51.0+dfsg1+llvm-1~exp3ubuntu1
4 bugs
patches for 1.51.0+dfsg1+llvm-1~exp3ubuntu1