Vulnerability Details CVE-2015-20001
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.0%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2015-20001
-
cpe:2.3:a:rust-lang:rust:0.1
-
cpe:2.3:a:rust-lang:rust:0.10
-
cpe:2.3:a:rust-lang:rust:0.11.0
-
cpe:2.3:a:rust-lang:rust:0.12.0
-
cpe:2.3:a:rust-lang:rust:0.2
-
cpe:2.3:a:rust-lang:rust:0.3
-
cpe:2.3:a:rust-lang:rust:0.3.1
-
cpe:2.3:a:rust-lang:rust:0.4
-
cpe:2.3:a:rust-lang:rust:0.5
-
cpe:2.3:a:rust-lang:rust:0.6
-
cpe:2.3:a:rust-lang:rust:0.7
-
cpe:2.3:a:rust-lang:rust:0.8
-
cpe:2.3:a:rust-lang:rust:0.9
-
cpe:2.3:a:rust-lang:rust:1.0.0
-
cpe:2.3:a:rust-lang:rust:1.1.0