Intel

AIKIDO-2024-10444

rustybuzz is vulnerable to Integer Overflow

Integer Overflow Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Nov 13, 2024

15

Low Risk

This Affects:

rustrustybuzz
0.7.0 - 0.20.0
Fixed in 0.20.1
Are you affected? Scan for Free

TL;DR

Affected versions of the package are vulnerable to an integer overflow, which could result in crashes or a Denial of Service (DoS). This flaw occurs when an integer value exceeds its maximum limit, potentially causing unexpected behavior or application instability.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

rustybuzz is vulnerable to Integer Overflow in versions 0.7.0 - 0.20.0.

How to fix this

Upgrade the rustybuzz library to the patch version.