Integer Overflow in Rust's Zip Library Can Lead to Buffer Overflow

CVE-2021-28879

Summary

The Zip implementation within Rust's standard library, prior to version 1.52.0, contains a flaw that can manifest as an integer overflow when processing Zip file sizes. This can result in the library returning an erroneous size, which may ultimately lead to a buffer overflow vulnerability if a Zip iterator that has already been consumed is reused. Consequently, this issue poses significant security risks, making it essential for users to update to the patched version to mitigate potential exploits.

References