~ / search / GHSA-v7q4-97x4-4qw2

GHSA-v7q4-97x4-4qw2

Use of Uninitialized Resource in truetype

Source: GitHub Advisory Database (reviewed) High CVE-2021-28030

Packages

EcosystemPackageAffectedFixed in
crates.io truetype < 0.30.1 0.30.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.

References

External links from the advisory. They lead to third-party sites.