Red Hat Security Advisory: rust-toolset-1.52 and rust-toolset-1.52-rust security and enhancement update

Fixed packages 17

Vulnerabilities 7

• Unscored —
  CVE-2020-36323

  In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialize…

  rustc rustc rust chromium-rust Debian Ubuntu Alpine
  Apr 14, 2021
• Unscored —
  CVE-2021-28875

  In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe …

  rustc rustc Debian Ubuntu
  Apr 11, 2021
• Unscored —
  CVE-2021-28876

  In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get…

  rustc rustc Debian Ubuntu
  Apr 11, 2021
• Unscored —
  CVE-2021-28877

  In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same ind…

  rustc rustc Debian Ubuntu
  Apr 11, 2021
• Unscored —
  CVE-2021-28878

  In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once f…

  rustc rustc Debian Ubuntu
  Apr 11, 2021
• Unscored —
  CVE-2021-28879 Public exploit

  In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ov…

  rustc rustc Debian Ubuntu
  Apr 11, 2021
• Unscored —
  CVE-2021-31162

  In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the el…

  rustc rustc rust chromium-rust Debian Ubuntu Alpine
  Apr 14, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_rust_1.52.1_toolset
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1949194
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1949198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1949204
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1949207
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1949211
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1950396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1950398
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3042.json
• report
  https://access.redhat.com/security/cve/CVE-2020-36323
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36323
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36323
• report
  https://access.redhat.com/security/cve/CVE-2021-28875
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28875
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28875
• report
  https://access.redhat.com/security/cve/CVE-2021-28876
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28876
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28876
• report
  https://access.redhat.com/security/cve/CVE-2021-28877
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28877
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28877
• report
  https://access.redhat.com/security/cve/CVE-2021-28878
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28878
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28878
• report
  https://access.redhat.com/security/cve/CVE-2021-28879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28879
• report
  https://access.redhat.com/security/cve/CVE-2021-31162
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-31162
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-31162