rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2025-12-27 01:54:07 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
8c05fea5fa6e1776c015b855eebaa344d00e28a7
advisory-db/crates/flatbuffers/RUSTSEC-2019-0028.md
Alexis Mousset 8c05fea5fa Add cvss information from nvd (#1085)
2021-10-19 16:14:35 -06:00

683 B
Raw Blame History 

[advisory]
id = "RUSTSEC-2019-0028"
package = "flatbuffers"
aliases = ["CVE-2019-25004"]
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
date = "2019-10-20"
url = "https://github.com/google/flatbuffers/issues/5530"

[affected.functions]
"flatbuffers::Follow::follow" = [">= 0.4.0", "<= 0.6.0"]

[versions]
patched = [">= 0.6.1"]
unaffected = ["< 0.4.0"]

Unsound impl Follow for bool

The implementation of impl Follow for bool allows to reinterpret arbitrary bytes as a bool.

In Rust bool has stringent requirements for its in-memory representation. Use of this function allows to violate these requirements and invoke undefined behaviour in safe code.