CVE-2019-16138 - An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder

Back Back to CVE browser

CRITICAL

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder

Published Sep 9, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 2.48%

Description

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (4)

https://github.com/advisories/GHSA-m2pf-hprp-3vqm
Advisory
https://github.com/image-rs/image/pull/985
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16138
https://rustsec.org/advisories/RUSTSEC-2019-0014.html
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-m2pf-hprp-3vqm		Advisory
https://github.com/image-rs/image/pull/985		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16138
https://rustsec.org/advisories/RUSTSEC-2019-0014.html		x_refsource_MISCThird Party Advisory