CRITICAL9.8

GHSA-ppqp-78xx-3r38

Out of bounds write in calamine

Details

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/calamine

Introduced in: 0Fixed in: 0.17.0

Upgrade calamine to 0.17.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2021-26951[ADVISORY]
https://github.com/tafia/calamine/issues/199[WEB]
https://github.com/tafia/calamine[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0015.html[WEB]