Vulnerability Database
296,746
Total vulnerabilities in the database
mozjpeg DecompressScanlines::read_scanlines is Unsound
This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on.
Affected versions of mozjpeg crate allow creating instances of any type T from bytes,
and do not correctly constrain T to the types for which it is safe to do so.
Examples of safety violation possible for a type T:
Tcontains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.Trequires a safety and/or validity invariant for its construction that may be violated.
The issue was fixed in 0.8.19 by using safer types and involving rgb dependency bump.
| Software | From | Fixed in |
|---|---|---|
mozjpeg
|
- | 0.8.19 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime