Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

lzf

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Invalid use of mem::uninitialized causes use-of-uninitialized-value

    GHSA-5m39-wx2q-mxg3

    Affected
    • crates.io lzf < 0.3.2
    Fixed in
    0.3.2· Vendor fix available
    Issue
    The compression and decompression function used mem:uninitialized to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory. The flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf by using a heap-allocated Vec and removing out use of mem::uninitialized. The fix was released in v0.3.2 and v1.0.0 Subsequently, the crate was deprecated and its use is discouraged.

    Recommended action: Upgrade to 0.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →