Critical · 9.8 CVE-2020-35886 CVE-2020-35887CVE-2020-35888EUVD-2021-1675GHSA-36xw-hgfv-jwm7GHSA-c7fw-cr3w-wvfcGHSA-fhvj-7f9p-w788RUSTSEC-2020-0034

Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr

Published Dec 31, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: arr Ecosystem: crates.io

Description

An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
crates.io	arr	<= 0.6.1	—	GHSA-36xw-hgfv-jwm7
crates.io	arr	>= 0.0.0-0	—	RUSTSEC-2020-0034

References

https://rustsec.org/advisories/RUSTSEC-2020-0034.html