CVE-2021-28030

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::takebytes...

font (>=0.0.2, <=0.3.2), msdfgen (0.1.0) +2 more potentially affected by CVE-2021-28030 via truetype (>=0.3.0, <=0.22.0)

truetype CARGO version =0.3.0, =0.0.2, =0.4.3, =0.0.2, =0.0.4 Source cves: CVE-2021-28030 Source advisory: OSV:GHSA-V7Q4-97X4-4QW2...

CVE-2021-28030

CVE-2021-28030 affects the Rust truetype crate prior to 0.30.1. The issue arises from a user-provided Read operation in Tape::take_bytes that can read contents from uninitialized memory. Impact is information disclosure of uninitialized memory. A fix was implemented by removing the unsafe usage a...