CVE-2018-20992

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Aug 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-209937.5An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.CVE-2018-209947.5An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compressCVE-2018-209959.8An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates CVE-2018-209969.8An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.CVE-2018-209979.8An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.CVE-2018-209989.8An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to CVE-2018-209997.5An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.CVE-2018-210009.8An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap mCVE-2018-210016.1The anycomment plugin before 0.0.33 for WordPress has XSS.CVE-2018-210028.8The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.CVE-2018-210039.8The buddyforms plugin before 2.2.8 for WordPress has SQL injection.CVE-2018-210049.8The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.
CVE-2018-20992: Medium severity, CVSS 6.5 | Vulnix