GitHub Advisoryadvisory · crates.io

GHSA-ppqp-78xx-3r38 Out of bounds write in calamine

CRITICAL Published 2021-08-25 Modified 2022-04-26 Official page ↗
Aliases
CVE-2021-26951
Ecosystem
crates.io
Packages
calamine
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-787
Reviewed
2021-08-19

Affected packages

• crates.io calamine: < 0.17.0 → fixed in 0.17.0

Description

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.

Related

Alias · CVE (1)

  • CVE-2021-26951 An issue was discovered in the calamine crate before 0.17.0 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References