CVE-2018-20989

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-191

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-209907.5An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archiCVE-2018-209919.8An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a doubleCVE-2018-209926.5An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes aCVE-2018-209937.5An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.CVE-2018-209947.5An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compressCVE-2018-209959.8An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates CVE-2018-209969.8An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.CVE-2018-209979.8An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.CVE-2018-209989.8An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to CVE-2018-209997.5An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.CVE-2018-210009.8An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap mCVE-2018-210016.1The anycomment plugin before 0.0.33 for WordPress has XSS.