Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. mozjpeg
  4. ›
  5. GHSA-v8gq-5grq-9728

GHSA-v8gq-5grq-9728: mozjpeg DecompressScanlines::read_scanlines is Unsound

September 16, 2022

This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on.

Affected versions of mozjpeg crate allow creating instances of any type T from bytes, and do not correctly constrain T to the types for which it is safe to do so.

Examples of safety violation possible for a type T:

  • T contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.
  • T requires a safety and/or validity invariant for its construction that may be violated.

The issue was fixed in 0.8.19 by using safer types and involving rgb dependency bump.

References

  • github.com/ImageOptim/mozjpeg-rust
  • github.com/ImageOptim/mozjpeg-rust/issues/10
  • github.com/advisories/GHSA-v8gq-5grq-9728
  • rustsec.org/advisories/RUSTSEC-2020-0165.html

Code Behaviors & Features

Detect and mitigate GHSA-v8gq-5grq-9728 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.8.19

Fixed versions

  • 0.8.19

Solution

Upgrade to version 0.8.19 or above.

Source file

cargo/mozjpeg/GHSA-v8gq-5grq-9728.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:57 +0000.