servo smallvec vulnerabilities

Latest servo smallvec CVEs

Newest publication first

1. CVE-2018-25023 Use of Uninitialized Resource in smallvec

   Published 2021-12-26

   High·CVSS 7.5

   An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.

2. CVE-2021-25900 Buffer overflow in SmallVec::insert_many

   Published 2021-01-22

   Critical·CVSS 9.8

   An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

3. CVE-2019-15551 Double free in smallvec

   Published 2019-08-26

   Critical·CVSS 9.8

   An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.

4. CVE-2019-15554 Memory corruption in smallvec

   Published 2019-08-26

   Critical·CVSS 9.8

   An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.

5. CVE-2018-20991 Double free in smallvec

   Published 2019-08-26

   Critical·CVSS 9.8

   An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.