GHSA-6692-8QQF-79JC高危已审查已撤回

Duplicate Advisory: `Read` on uninitialized buffer may cause UB ('tectonic_xdv' crate)

OSV 1.4.0 · github-reviewed · 修改于 2026-02-04 03:37

发布时间

2022-06-17 08:24

GitHub 审查时间

2022-06-17 08:24

NVD 发布时间

—

源文件

advisories/github-reviewed/2022/06/GHSA-6692-8qqf-79jc/GHSA-6692-8qqf-79jc.json

该公告已于 2026-02-04 03:37 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-qwvx-c8j7-5g75. This link is maintained to preserve external references.

Original Description

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

The problem was fixed in commit cdff034 by zero-initializing the buffer before passing it to a user-provided Read implementation.

受影响的软件包

crates.io

tectonic_xdv

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

无

软件生态

crates.io

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-6692-8qqf-79jc",
  "aliases": [],
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qwvx-c8j7-5g75. This link is maintained to preserve external references.\n\n## Original Description\nAffected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.\n\nArbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.\n\nThe problem was fixed in commit `cdff034` by zero-initializing the buffer before passing it to a user-provided `Read` implementation.",
  "summary": "Duplicate Advisory: `Read` on uninitialized buffer may cause UB ('tectonic_xdv' crate)",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.12"
            }
          ]
        }
      ],
      "package": {
        "name": "tectonic_xdv",
        "ecosystem": "crates.io"
      }
    }
  ],
  "modified": "2026-02-03T19:37:22Z",
  "severity": [],
  "published": "2022-06-17T00:24:29Z",
  "withdrawn": "2026-02-03T19:37:21Z",
  "references": [
    {
      "url": "https://github.com/tectonic-typesetting/tectonic/issues/752",
      "type": "WEB"
    },
    {
      "url": "https://github.com/tectonic-typesetting/tectonic/commit/cdff034e6d93cdfdafd13d8c6956e22fa5a57b79",
      "type": "WEB"
    },
    {
      "url": "https://github.com/tectonic-typesetting/tectonic",
      "type": "PACKAGE"
    },
    {
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0112.html",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2022-06-17T00:24:29Z"
  }
}