mirror of
https://github.com/OMGeeky/advisory-db.git
synced 2026-01-20 02:21:00 +01:00
64c17acfe3
As announced in #228, this commit migrates all advisories to the new V2 format, which splits version information into a separate section, and now has a structure which corresponds to the internal code structure of the `rustsec` crate. This is a breaking change for users of `cargo-audit` < 0.9, and anyone who has written a 3rd party advisory format parser.
22 lines
873 B
TOML
22 lines
873 B
TOML
[advisory]
|
|
id = "RUSTSEC-2019-0009"
|
|
package = "smallvec"
|
|
date = "2019-06-06"
|
|
title = "Double-free and use-after-free in SmallVec::grow()"
|
|
url = "https://github.com/servo/rust-smallvec/issues/148"
|
|
keywords = ["double free", "use after free", "arbitrary code execution"]
|
|
description = """
|
|
Attempting to call `grow` on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents.
|
|
|
|
An attacker that controls the value passed to `grow` may exploit this flaw to obtain memory contents or gain remote code execution.
|
|
|
|
Credits to @ehuss for discovering, reporting and fixing the bug.
|
|
"""
|
|
|
|
[affected.functions]
|
|
"smallvec::SmallVec::grow" = ["< 0.6.10, >= 0.6.5"]
|
|
|
|
[versions]
|
|
patched = [">= 0.6.10"]
|
|
unaffected = ["< 0.6.5"]
|