GHSA-9wgh-vjj7-7433

Source

https://github.com/advisories/GHSA-9wgh-vjj7-7433

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-9wgh-vjj7-7433/GHSA-9wgh-vjj7-7433.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9wgh-vjj7-7433

Aliases

Published

2021-08-25T20:49:54Z

Modified

2023-11-08T04:03:39.222638Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Mutable reference with immutable provenance in image

Details

A mutable reference to a struct was constructed by dereferencing a pointer obtained from slice::asptr. Instead, slice::asmut_ptr should have been called on the mutable slice argument. The former performs an implicit reborrow as an immutable shared reference which does not allow writing through the derived pointer.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T20:49:50Z"
}

References

Affected packages

crates.io / image

Package

Name: image; View open source insights on deps.dev
Purl: pkg:cargo/image

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.23.12

Ecosystem specific

{
    "affected_functions": [
        "image::Bgr::from_slice_mut",
        "image::Bgra::from_slice_mut",
        "image::Luma::from_slice_mut",
        "image::LumaA::from_slice_mut",
        "image::Rgb::from_slice_mut",
        "image::Rgba::from_slice_mut"
    ]
}