{"id":"GHSA-v8gq-5grq-9728","summary":"mozjpeg DecompressScanlines::read_scanlines is Unsound","details":"This issue and vector is similar to [RUSTSEC-2020-0029] of `rgb` crate which `mozjpeg` depends on.\n\nAffected versions of `mozjpeg` crate allow creating instances of any type `T` from bytes,\nand do not correctly constrain `T` to the types for which it is safe to do so.\n\nExamples of safety violation possible for a type `T`:\n\n* `T` contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.\n* `T` requires a safety and/or validity invariant for its construction that may be violated.\n\nThe issue was fixed in 0.8.19 by using safer types and involving `rgb` dependency bump.\n\n[RUSTSEC-2020-0029]: https://rustsec.org/advisories/RUSTSEC-2020-0029.html\n","aliases":["RUSTSEC-2020-0165"],"modified":"2023-11-08T04:23:09.541378Z","published":"2022-09-16T21:03:43Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-09-16T21:03:43Z"},"references":[{"type":"WEB","url":"https://github.com/ImageOptim/mozjpeg-rust/issues/10"},{"type":"PACKAGE","url":"https://github.com/ImageOptim/mozjpeg-rust"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2020-0165.html"}],"affected":[{"package":{"name":"mozjpeg","ecosystem":"crates.io","purl":"pkg:cargo/mozjpeg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.19"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-v8gq-5grq-9728/GHSA-v8gq-5grq-9728.json"}}],"schema_version":"1.9.0"}