Lucene search

GitHub Advisory DatabaseGHSA-V7Q4-97X4-4QW2

HistoryAug 25, 2021 - 8:51 p.m.

Use of Uninitialized Resource in truetype

2021-08-2520:51:58

CWE-908

GitHub Advisory Database

github.com

truetype crate

rust

uninitialized memory

read operation

tape::take_bytes

security issue

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

53.8%

JSON

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.

Affected configurations

Vulners

Node

truetype_projecttruetypeRange<0.30.1rust

VendorProductVersionCPE
truetype_projecttruetype*cpe:2.3:a:truetype_project:truetype:*:*:*:*:*:rust:*:*

Vendor	Product	Version	CPE
truetype_project	truetype	*	cpe:2.3:a:truetype_project:truetype::::::rust::*

References

github.com/advisories/GHSA-v7q4-97x4-4qw2

github.com/bodoni/truetype/issues/11

nvd.nist.gov/vuln/detail/CVE-2021-28030

rustsec.org/advisories/RUSTSEC-2021-0029.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

53.8%

JSON

Related for GHSA-V7Q4-97X4-4QW2