HIGH7.5

GHSA-v7q4-97x4-4qw2

Use of Uninitialized Resource in truetype

Details

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/truetype

Introduced in: 0Fixed in: 0.30.1

Upgrade truetype to 0.30.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2021-28030[ADVISORY]
https://github.com/bodoni/truetype/issues/11[WEB]
https://github.com/bodoni/truetype[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0029.html[WEB]