CVE-2020-26235: In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific…

PriorityP427medium5.3CVSS 3.1

AVNACHPRLUINSUCNINAH

EPSS

1.88%

76.8th percentile

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	rust-time	—	—
time-rs	time	—	—
time_project	time	>= 0.0.0-0 < 0.2.0	0.2.0
time_project	time	>= 0.1.0 < 0.2.23	0.2.23
time_project	time	>= 0.2.1-0 < 0.2.1	0.2.1
time_project	time	>= 0.2.2-0 < 0.2.2	0.2.2
time_project	time	>= 0.2.3-0 < 0.2.3	0.2.3
time_project	time	>= 0.2.4-0 < 0.2.4	0.2.4
time_project	time	>= 0.2.5-0 < 0.2.5	0.2.5
time_project	time	>= 0.2.6-0 < 0.2.6	0.2.6
time_project	time	>= 0.2.7 < 0.2.23	0.2.23
time_project	time	>= 0.2.7 < 0.2.23	0.2.23
time_project	time	>= 0.2.7-0 < 0.2.23	0.2.23

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:N/A:P

ghsa5.3MEDIUM

osv5.3MEDIUM

vendor_debian5.3LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.