Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-vayp-d8jv-e7c4 |
| Summary | `simd-json-derive` vulnerable to `MaybeUninit` misuse
An invalid use of `MaybeUninit::uninit().assume_init()` in `simd-json-derive`'s derive macro can cause undefined behavior. The original code used `MaybeUninit` to avoid initialisation of the struct and then set the fields using `ptr::write`. The undefined behavior triggered by this misuse of `MaybeUninit` can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)
The version `0.12.0` removes this section of code, avoiding the use of MaybeUninit alltogether. |
| Aliases |
| 0 |
| alias |
GHSA-pqpw-89w5-82v5 |
|
|
| Fixed_packages |
|
| Affected_packages |
|
| References |
|
| Weaknesses |
|
| Exploits |
|
| Severity_range_score | 4.0 - 6.9 |
| Exploitability | null |
| Weighted_severity | null |
| Risk_score | null |
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-vayp-d8jv-e7c4 |