{"id":"CVE-2020-35916","aliases":["DEBIAN-CVE-2020-35916","EUVD-2021-1669","GHSA-9wgh-vjj7-7433","RUSTSEC-2020-0073","UBUNTU-CVE-2020-35916"],"status":"published","title":"Mutable reference with immutable provenance in image","description":"An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00389,"percentile":0.33262,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-11-12T12:00:00Z","modified":"2026-10-26T12:02:00Z","fixes":[{"ecosystem":"crates.io","package":"image","fixed_in":["0.23.12"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rust-image","fixed_in":["0.23.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-image","fixed_in":["0.23.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-image","fixed_in":["0.23.14-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.14-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"image","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.12"}]}]},{"source":"osv","ecosystem":"crates.io","package":"image","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.23.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.7-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25.5-3","0.25.6-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25.8-3","0.25.10-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25.6-2ubuntu1","0.25.6-3","0.25.8-1","0.25.8-2","0.25.8-3"]}],"products":[{"vendor":"image-rs","product":"image"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0073.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35916","tags":["advisory"]},{"url":"https://github.com/image-rs/image/issues/1357","tags":["web","report"]},{"url":"https://github.com/image-rs/image/pull/1358","tags":["web"]},{"url":"https://github.com/image-rs/image/commit/5cbe1e6767d11aff3f14c7ad69a06b04e8d583c7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9wgh-vjj7-7433"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35916","tags":["advisory"]},{"url":"https://github.com/image-rs/image","tags":["package"]},{"url":"https://crates.io/crates/image","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-35916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35916","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-35916","description":"An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)","status":"published","published":"2020-12-31T08:18:49Z","modified":"2024-08-04T17:16:13.218Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2021-1669","description":"An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)","status":"published","published":"2020-12-31T08:18:49Z","modified":"2024-08-04T17:16:13Z","updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-9wgh-vjj7-7433","title":"Mutable reference with immutable provenance in image","description":"A mutable reference to a struct was constructed by dereferencing a pointer obtained from slice::as_ptr. Instead, slice::as_mut_ptr should have been called on the mutable slice argument. The former performs an implicit reborrow as an immutable shared reference which does not allow writing through the derived pointer.","status":"published","published":"2021-08-25T20:49:54Z","modified":"2023-06-13T18:17:31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:53.654352Z"}],"nvd":[{"id":"CVE-2020-35916","description":"An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)","status":"published","published":"2020-12-31T09:15:15.77Z","modified":"2026-06-17T03:14:35.987Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35916","description":"An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)","status":"published","published":"2020-12-31T09:15:15.77Z","modified":"2026-10-24T10:31:06.196997628Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35916","description":"An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)","status":"published","published":"2020-12-31T09:15:15.77Z","modified":"2026-10-26T12:02:00.99541586Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-9wgh-vjj7-7433","title":"Mutable reference with immutable provenance in image","description":"A mutable reference to a struct was constructed by dereferencing a pointer obtained from slice::as_ptr. Instead, slice::as_mut_ptr should have been called on the mutable slice argument. The former performs an implicit reborrow as an immutable shared reference which does not allow writing through the derived pointer.","status":"published","published":"2021-08-25T20:49:54Z","modified":"2023-11-08T04:03:39.222638Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"RUSTSEC-2020-0073","title":"Mutable reference with immutable provenance","description":"A mutable reference to a struct was constructed by dereferencing a pointer\nobtained from `slice::as_ptr`. Instead, `slice::as_mut_ptr` should have been\ncalled on the mutable slice argument. The former performs an implicit reborrow\nas an immutable shared reference which does not allow writing through the\nderived pointer.\n\nThere is no evidence for miscompilation, exploitable or otherwise, caused by\nthis bug. [Further investigation on Zulip][Zulip] suggests that the unoptimized\ngenerated LLVM IR does not contain any UB itself, effectively mitigating\nfurther effects.\n\n[Zulip]: https://rust-lang.zulipchat.com/#narrow/stream/146229-wg-secure-code/topic/Implications.20of.20using.20.60slice.3A.3Aas_ptr.60.20for.20mutable.20access/near/216499472","status":"published","published":"2020-11-12T12:00:00Z","modified":"2023-11-08T04:03:39.222638Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2020-35916","description":"An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)","status":"published","published":"2020-12-31T09:15:00Z","modified":"2026-10-17T12:55:52.976012311Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:25.179924Z"}]}}