{"id":"GHSA-5m39-wx2q-mxg3","aliases":["RUSTSEC-2022-0067"],"status":"published","title":"Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`","description":"The compression and decompression function used `mem:uninitialized` to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory.\n\nThe flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf by using a heap-allocated `Vec` and removing out use of `mem::uninitialized`. The fix was released in v0.3.2 and v1.0.0\n\nSubsequently, the crate was deprecated and its use is discouraged.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-10-22T12:00:00Z","modified":"2023-11-08T04:15:48Z","fixes":[{"ecosystem":"crates.io","package":"lzf","fixed_in":["0.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"lzf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"lzf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"lzf","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.2"}]}]}],"references":[{"url":"https://github.com/badboy/lzf-rs/issues/9","tags":["web","report"]},{"url":"https://github.com/badboy/lzf-rs/commit/b633bf265e41c60dfce3be7eac4e4dd5e18d06cf","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0067.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5m39-wx2q-mxg3"},{"url":"https://github.com/badboy/lzf-rs","tags":["package"]},{"url":"https://crates.io/crates/lzf","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-5m39-wx2q-mxg3","title":"Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`","description":"The compression and decompression function used `mem:uninitialized` to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory.\n\nThe flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf by using a heap-allocated `Vec` and removing out use of `mem::uninitialized`. The fix was released in v0.3.2 and v1.0.0\n\nSubsequently, the crate was deprecated and its use is discouraged.\n","status":"published","published":"2022-11-08T21:42:06Z","modified":"2023-08-25T00:12:30Z","updated_at":"2026-11-02T14:37:00.680009Z"}],"osv":[{"id":"GHSA-5m39-wx2q-mxg3","title":"Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`","description":"The compression and decompression function used `mem:uninitialized` to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory.\n\nThe flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf by using a heap-allocated `Vec` and removing out use of `mem::uninitialized`. The fix was released in v0.3.2 and v1.0.0\n\nSubsequently, the crate was deprecated and its use is discouraged.\n","status":"published","published":"2022-11-08T21:42:06Z","modified":"2023-11-08T04:15:48.003089Z","updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"RUSTSEC-2022-0067","title":" Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`","description":"The compression and decompression function used `mem:uninitialized`\nto create an array of uninitialized values, to later write values into it.\nThis later leads to reads from uninitialized memory.\n\nThe flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf\nby using a heap-allocated `Vec` and removing out use of `mem::uninitialized`.\nThe fix was released in v0.3.2 and v1.0.0\n\nSubsequently the crate was deprecated and its use is discouraged.","status":"published","published":"2022-10-22T12:00:00Z","modified":"2023-11-08T04:15:48.003089Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}