Description
An issue was discovered in USC iLab cereal through 1.3.0. Serialization of an (initialized) C/C++ long double variable into a BinaryArchive or PortableBinaryArchive leaks several bytes of stack or heap memory, from which sensitive information (such as memory layout or private keys) can be gleaned if the archive is distributed outside of a trusted context.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/USCiLab/cereal/issues/625
Scores
CVSS v3
5.3
EPSS
0.0153
EPSS Percentile
71.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-908
Status
published
Products (1)
usc/cereal
< 1.3.0
Published
Mar 30, 2020
Tracked Since
Feb 18, 2026