Uninitialized Value Vulnerability in smallvec Crate by Rust
CVE-2018-25023

7.5HIGH

Key Information:

Vendor

Servo

Status
Smallvec
Vendor
CVE Published:
27 December 2021

What is CVE-2018-25023?

An issue in the smallvec crate prior to version 0.6.13 allows for the creation of uninitialized values of any type, including reference types. This could potentially lead to undefined behavior, making it crucial for developers to update to secure versions to mitigate risks associated with memory safety. Regular updates and security assessments are recommended to protect applications built with this crate.

References

https://rustsec.org/advisories/RUSTSEC-2018-0018.html
https://raw.githubusercontent.com/rustsec/advisory-db/mai...
https://github.com/servo/rust-smallvec/commit/e64afc8c473...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.