Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerable library smallvec version 1.2 #6

Open
beta-vulnerability-notify bot opened this issue Sep 19, 2019 · 0 comments
Open

Vulnerable library smallvec version 1.2 #6

beta-vulnerability-notify bot opened this issue Sep 19, 2019 · 0 comments

Comments

@beta-vulnerability-notify
Copy link

A vulnerability has been found in the library smallvec.

The description is:
Description Attempting to call grow on a spilled SmallVec with a value less than the current capacity causes corruption of memory allocator data structures. An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution. Credits to @ehuss for discovering, reporting and fixing the bug. More Info servo/rust-smallvec#149 Patched Versions >= 0.6.10

Please fix this as soon as possible
Link to read more about the vulnerability:
https://watchers.firosolutions.com/vuln/view/RUSTSEC-2019-0012: smallvec: Memory corruption in SmallVec::grow()

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

0 participants