CVE-2019-16137

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-662

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://rustsec.org/advisories/RUSTSEC-2019-0013.htmlThird Party Advisory
https://rustsec.org/advisories/RUSTSEC-2019-0013.htmlThird Party Advisory

Timeline

Published: Sep 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-161389.8An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an unin CVE-2019-161399.8An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or r CVE-2019-16148.8A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands wi CVE-2019-161409.8An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.CVE-2019-161417.5An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.CVE-2019-161429.8An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is in CVE-2019-161439.8An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrec CVE-2019-161447.5An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API ca CVE-2019-161456.1The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.CVE-2019-161464.8Gophish through 0.8.0 allows XSS via a username.CVE-2019-161476.1Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.CVE-2019-161486.1Sakai through 12.6 allows XSS via a chat user name.