RUSTSEC-2020-0007

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2020-0007

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0007.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2020-0007

Aliases

CVE-2020-35862
GHSA-7cjc-hvxf-gqh7

Published

2020-03-27T12:00:00Z

Modified

2023-11-08T04:03:36Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

use-after or double free of allocated memory

Details

Conversion of BitVec to BitBox did not account for allocation movement.

The flaw was corrected by using the address after resizing, rather than the original base address.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / bitvec

Package

Name: bitvec; View open source insights on deps.dev
Purl: pkg:cargo/bitvec

Affected ranges

Type: SEMVER
Events: Introduced

0.11.0

Fixed

0.17.4

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "bitvec::vec::BitVec::into_boxed_bitslice"
        ],
        "os": []
    }
}