{"id":"CVE-2021-29934","aliases":["EUVD-2021-1912","GHSA-w9vv-q986-vj7x","RUSTSEC-2021-0043"],"status":"published","title":"Out of bounds read in uu_od","description":"An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00932,"percentile":0.61172,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-908"],"published":"2021-02-17T12:00:00Z","modified":"2026-06-17T03:48:28Z","fixes":[{"ecosystem":"crates.io","package":"uu_od","fixed_in":["0.0.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"uu_od","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"uu_od","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"uu_od","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.0.4"}]}]}],"products":[{"vendor":"uu_od_project","product":"uu_od"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0043.html","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29934","tags":["advisory"]},{"url":"https://github.com/uutils/coreutils/issues/1729","tags":["web","report"]},{"url":"https://github.com/uutils/coreutils/pull/1730","tags":["web"]},{"url":"https://github.com/uutils/coreutils/pull/1738","tags":["web"]},{"url":"https://github.com/uutils/coreutils/pull/1739","tags":["web"]},{"url":"https://github.com/uutils/coreutils/commit/39d62c6c1f809022c903180471c10fde6ecd12d1","tags":["web"]},{"url":"https://github.com/uutils/coreutils/commit/5935876f38498b0c1f657d031171eb17028def6f","tags":["web"]},{"url":"https://github.com/uutils/coreutils/commit/7341a1a033aa5980ac59bc9d4df978b396de4fad","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w9vv-q986-vj7x"},{"url":"https://github.com/uutils/coreutils","tags":["package"]},{"url":"https://crates.io/crates/uu_od","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-29934","description":"An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.","status":"published","published":"2021-04-01T04:24:14Z","modified":"2024-08-03T22:18:03.256Z","updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-1912","description":"An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.","status":"published","published":"2021-04-01T04:24:14Z","modified":"2024-08-03T22:18:03Z","updated_at":"2026-11-03T03:24:43.413555Z"}],"ghsa":[{"id":"GHSA-w9vv-q986-vj7x","title":"Out of bounds read in uu_od","description":"An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.","status":"published","published":"2021-08-25T20:54:24Z","modified":"2023-05-22T16:06:49Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2021-29934","description":"An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.","status":"published","published":"2021-04-01T05:15:14.53Z","modified":"2026-06-17T03:48:28.12Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-125","CWE-908"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"GHSA-w9vv-q986-vj7x","title":"Out of bounds read in uu_od","description":"An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.","status":"published","published":"2021-08-25T20:54:24Z","modified":"2023-11-08T04:05:43.759302Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"RUSTSEC-2021-0043","title":"PartialReader passes uninitialized memory to user-provided Read","description":"Affected versions of this crate passed an uniniitalized buffer to a\nuser-provided `Read` instance in `PartialReader::read`.\n\nThis can result in safe `Read` implementations reading from the uninitialized\nbuffer leading to undefined behavior.\n\nThe flaw was fixed in commit [`39d62c6`](https://github.com/uutils/coreutils/commit/39d62c6c1f809022c903180471c10fde6ecd12d1)\nby zero-initializing the passed buffer.","status":"published","published":"2021-02-17T12:00:00Z","modified":"2023-11-08T04:05:43.759302Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}