Use-After-Free Vulnerability in HDR Image Format Decoder by Rust
CVE-2019-16138

9.8CRITICAL

Key Information:

Vendor

Image-rs

Status
Image
Vendor
CVE Published:
9 September 2019

What is CVE-2019-16138?

The vulnerability in the HDR image format decoder of Rust's image crate prior to version 0.21.3 allows an attacker to exploit Vec::set_len being called on an uninitialized vector. This can result in a use-after-free condition, potentially leading to arbitrary code execution. It is crucial for developers using affected versions to update to a patched version to mitigate this risk. Further details can be found in the advisory and GitHub pull request.

References

https://rustsec.org/advisories/RUSTSEC-2019-0014.html
x_refsource_MISC
https://github.com/image-rs/image/pull/985
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.