Apache Arrow Rust
Monthly
Out-of-bounds read in Apache Arrow Rust (`arrow` crate) versions 33.0.0 through 57.3.1, 58.4.0, 59.3.1, and 60.0.0 can expose memory contents beyond a RunEndEncoded child values array when malformed run-end values are accepted through the ArrayData interface. The independent assessment assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making this remote and unauthenticated, but practical exposure is limited to applications that pass untrusted or malformed RunEndEncoded data into that interface; applications processing only trusted, internally generated Arrow data are not realistically exposed. No public exploit has been identified at time of analysis, and the vendor recommends upgrading to 60.1.0, 59.3.2, 58.4.1, or 57.3.2.
Out-of-bounds read in Apache Arrow Rust (`arrow` crate) versions 33.0.0 through 57.3.1, 58.4.0, 59.3.1, and 60.0.0 can expose memory contents beyond a RunEndEncoded child values array when malformed run-end values are accepted through the ArrayData interface. The independent assessment assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making this remote and unauthenticated, but practical exposure is limited to applications that pass untrusted or malformed RunEndEncoded data into that interface; applications processing only trusted, internally generated Arrow data are not realistically exposed. No public exploit has been identified at time of analysis, and the vendor recommends upgrading to 60.1.0, 59.3.2, 58.4.1, or 57.3.2.