{"id":"CVE-2019-12083","aliases":["ALPINE-CVE-2019-12083","BELL-CVE-2019-12083","EUVD-2019-3736","GHSA-vc89-vpx6-fmpm","SUSE-SU-2019:2439-1","SUSE-SU-2019:2755-1","openSUSE-SU-2019:2203-1","openSUSE-SU-2019:2244-1","openSUSE-SU-2019:2294-1","openSUSE-SU-2024:11359-1","openSUSE-SU-2024:11360-1"],"status":"published","title":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method...","description":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02216,"percentile":0.82764,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2019-05-13T19:06:01Z","modified":"2026-11-03T06:32:34Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"chromium-rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rust","fixed_in":["1.34.2-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"chromium-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.34.2-r0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-lp151.5.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust-cbindgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-lp151.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-lp151.5.4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-lp151.5.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust-cbindgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-lp151.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-2.5"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"rust-lang","product":"rust"}],"references":[{"url":"https://groups.google.com/forum/#%21topic/rustlang-security-announcements/aZabeCMUv70","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://blog.rust-lang.org/2019/05/13/Security-advisory.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Vendor Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K6T4BNA5KQYJRIKIGGBOGBMR7TRXPHLR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HG47HYH3AQTUMBUMX3S3G5DNAY4CBW6N/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12083"},{"url":"https://groups.google.com/forum/#!topic/rustlang-security-announcements/aZabeCMUv70"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HG47HYH3AQTUMBUMX3S3G5DNAY4CBW6N/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K6T4BNA5KQYJRIKIGGBOGBMR7TRXPHLR/"},{"url":"https://github.com/advisories/GHSA-vc89-vpx6-fmpm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-12083","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-12083","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192439-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1096945","tags":["report"]},{"url":"https://bugzilla.suse.com/1100691","tags":["report"]},{"url":"https://bugzilla.suse.com/1133283","tags":["report"]},{"url":"https://bugzilla.suse.com/1134978","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12083","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192755-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZOZ25VGM7BURWQNSR2QRJK6ZK2KHN2N/#MZOZ25VGM7BURWQNSR2QRJK6ZK2KHN2N","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VSDFMUYOGHL27XJBTF3UGFLJVXGMLKDW/#VSDFMUYOGHL27XJBTF3UGFLJVXGMLKDW","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/THHMWZRJWFDVITSZZRA3U6YLX2IZ53LA/#THHMWZRJWFDVITSZZRA3U6YLX2IZ53LA","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1967","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12083","description":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.","status":"published","published":"2019-05-13T19:06:01Z","modified":"2024-08-04T23:10:30.191Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-3736","description":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.","status":"published","published":"2019-05-13T19:06:01Z","modified":"2024-08-04T23:10:30Z","updated_at":"2026-11-03T02:40:47.406732Z"}],"ghsa":[{"id":"GHSA-vc89-vpx6-fmpm","title":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method...","description":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.","status":"published","published":"2022-05-24T16:45:33Z","modified":"2023-03-03T21:30:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:16.14777Z"}],"nvd":[{"id":"CVE-2019-12083","description":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.","status":"published","published":"2019-05-13T20:29:02.913Z","modified":"2026-06-17T02:14:01.753Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:05:13.880207Z"}],"osv":[{"id":"ALPINE-CVE-2019-12083","description":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.","status":"published","published":"2019-05-13T20:29:02.913Z","modified":"2026-11-03T06:32:34.794549174Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"BELL-CVE-2019-12083","title":"CVE-2019-12083 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:06.69236Z","modified":"2026-01-26T09:46:15.521196Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-12083","description":"The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.","status":"published","published":"2019-05-13T20:29:02.913Z","modified":"2026-10-24T10:30:29.053834091Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"openSUSE-SU-2019:2203-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\nThis update was imported from SUSE:SLE-15:Update.\n","status":"published","published":"2019-09-27T07:40:16Z","modified":"2026-02-04T02:47:26.846498Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2244-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-03T09:22:00Z","modified":"2026-02-04T02:42:56.822624Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2294-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-08T12:19:04Z","modified":"2026-02-04T03:25:11.006803Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11359-1","title":"cargo-1.54.0-1.2 on GA media","description":"These are all security issues fixed in the cargo-1.54.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:27.843903Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11360-1","title":"cargo1.53-1.53.0-2.5 on GA media","description":"These are all security issues fixed in the cargo1.53-1.53.0-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:23.126356Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:2439-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n","status":"published","published":"2019-09-23T15:14:47Z","modified":"2026-02-04T02:29:04.846849Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2755-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n","status":"published","published":"2019-10-23T13:24:35Z","modified":"2026-02-04T03:09:04.017636Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}