nabijaczleweli/safe-transmute-rs · Security
Heap overflow or corruption in safe-transmute
- GHSA ID
- GHSA-2v78-j59h-fmpf
- CVE ID
- CVE-2018-21000
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Affected versions of this crate switched the length and capacity arguments in the Vec::from_raw_parts() constructor, which could lead to memory corruption or data leakage.
CWEs
- CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-21000 ↗
- https://github.com/nabijaczleweli/safe-transmute-rs/pull/36 ↗
- https://rustsec.org/advisories/RUSTSEC-2018-0013.html ↗
- https://github.com/nabijaczleweli/safe-transmute-rs/commit/a134e06d740f9d7c287f74c0af2cd06206774364 ↗
- https://github.com/advisories/GHSA-2v78-j59h-fmpf ↗