DescriptionThe Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rustc (PTS)stretch1.34.2+dfsg1-1~deb9u1fixed
stretch (security)1.41.1+dfsg1-1~deb9u1fixed
bookworm, sid1.49.0+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rustcsourcejessie(not affected)
rustcsourcestretch(not affected)


[stretch] - rustc <not-affected> (Introduced in 1.26)
[jessie] - rustc <not-affected> (Vulnerable code not present)!topic/rustlang-security-announcements/CmSuTm-SaU0

Search for package or bug name: Reporting problems