CVE-2018-1000810

NameCVE-2018-1000810
DescriptionThe Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rustc (PTS)buster1.41.1+dfsg1-1~deb10u1fixed
bullseye1.48.0+dfsg1-2fixed
bookworm1.63.0+dfsg1-2fixed
trixie1.70.0+dfsg2-1fixed
sid1.71.1+dfsg1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rustcsourcejessie(not affected)
rustcsourcestretch(not affected)
rustcsource(unstable)1.30.0+dfsg1-1

Notes

[stretch] - rustc <not-affected> (Introduced in 1.26)
[jessie] - rustc <not-affected> (Vulnerable code not present)
https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html
https://groups.google.com/forum/#!topic/rustlang-security-announcements/CmSuTm-SaU0

Search for package or bug name: Reporting problems