RUSTSEC-2018-0004

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2018-0004

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2018-0004.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2018-0004

Aliases

Published

2018-08-25T12:00:00Z

Modified

2023-11-08T04:00:13.431426Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Malicious input could cause uninitialized memory to be exposed

Details

Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could be exposed.

This allows an attacker to observe parts of the uninitialized memory in the decoded audio stream.

The flaw was corrected by checking that the value read from the bitstream divides the decode buffer size, and returning a format error if it does not. If an error is returned, the decode buffer is not exposed. Regression tests and an additional fuzzer have been added to prevent similar flaws in the future.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / claxon

Package

Name: claxon; View open source insights on deps.dev
Purl: pkg:cargo/claxon

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.2

Introduced

0.4.0-0

Fixed

0.4.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

{
    "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
    "informational": null,
    "categories": []
}