CVE-2020-25016

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-119CWE-843

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-250178.3Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header CVE-2020-250187.5Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.CVE-2020-250197.5jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is CVE-2020-25026.1This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vCVE-2020-250209.8MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.CVE-2020-250219.8An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.CVE-2020-250229.8An issue was discovered in Noise-Java through 2020-08-27. AESGCMFallbackCipherState.encryptWithAd() allows out-of-bounds access.CVE-2020-250239.8An issue was discovered in Noise-Java through 2020-08-27. AESGCMOnCtrCipherState.encryptWithAd() allows out-of-bounds access.CVE-2020-250254.3The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information DisclosurCVE-2020-250264.3The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information DisclosureCVE-2020-25035.4If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP hasCVE-2020-250317.8checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file.