Vulnerability RUSTSEC-2021-0015
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
5 years ago
January 06, 2021 at 12:00 PM UTC
`Sectors::get` accesses unclaimed/uninitialized memory
0.1.0 - 0.16.2
0.1.0 - 0.16.2
Summary
`Sectors::get` accesses unclaimed/uninitialized memory
Details
Affected versions of this crate arbitrarily calls Vec::set_len to increase length of a vector without claiming more memory for the vector. Affected versions of this crate also calls user-provided Read on the uninitialized memory of the vector that was extended with Vec::set_len.
This can overwrite active entities in adjacent heap memory and seems to be a major security issue. Also, calling user-provided Read on uninitialized memory is defined as UB in Rust.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 days ago
Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input
0.1.0 - 0.37.0 RUSTSEC-2026-0436
0.1.0 - 0.37.0 RUSTSEC-2026-0436
Critical
5 years ago
Out of bounds write in calamine
0.1.0 - 0.16.2 GHSA-ppqp-78xx-3r38
0.1.0 - 0.16.2 GHSA-ppqp-78xx-3r38
Impacted packages
Timeline
Published
5 years ago
January 06, 2021 at 12:00 PM UTC
Fixed (0.17.0)
5 years ago
February 03, 2021 at 01:43 PM UTC
Last Modified
2 years ago
November 08, 2023 at 04:05 AM UTC