CVE-2019-12083

The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the Error::type_id method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.

References

Affected packages

Git / github.com/rust-lang/rust

Affected ranges

Type

GIT

Repo

https://github.com/rust-lang/rust

Events

Introduced

91856ed52c58aa5ba66a015354d1cc69e9779bdf

Fixed

6c2484dc3c532c052f159264e970278d8b77cdc9

Database specific

{
    "versions": [
        {
            "introduced": "1.34.0"
        },
        {
            "fixed": "1.34.2"
        }
    ]
}

Affected versions

1.*

1.34.0

1.34.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12083.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "29"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "30"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    }
]