CVE catalog

CVE-2021-28878

rustc: CVE-2021-28878

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.00% · Oct 25, 2026

In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrustcsid1.97.1+dfsg1-1fixed
Debianrustcforky1.97.1+dfsg1-1fixed
Debianrustctrixie1.85.1+dfsg1-1+deb13u1fixed
Debianrustcbookworm1.63.0+dfsg1-2fixed
Ubunturustcpro1.7.0+dfsg1-1vulnerable
Ubunturustcpro1.15.1+dfsg0-1~exp1ubuntu2~16.04.3vulnerable
Ubunturustcpro1.17.0+dfsg2-8~ubuntu0.16.04.2vulnerable
Ubunturustcpro1.21.0+dfsg1+llvm-0ubuntu3~16.04.1vulnerable
Ubunturustcpro1.22.1+dfsg1+llvm-0ubuntu2~16.04.2vulnerable
Ubunturustcpro1.24.1+dfsg1+llvm-0ubuntu1~16.04.1vulnerable
Ubunturustcpro1.25.0+dfsg1+llvm-0ubuntu1~16.04.1vulnerable
Ubunturustcpro1.28.0+dfsg1+llvm-0ubuntu1~16.04.1vulnerable
Ubunturustcpro1.30.0+dfsg1+llvm-2ubuntu1~16.04.1vulnerable
Ubunturustcpro1.31.0+dfsg1+llvm-2ubuntu1~16.04.1vulnerable
Ubunturustcpro1.32.0+dfsg1+llvm-1ubuntu1~16.04.1vulnerable
Ubunturustcpro1.34.1+dfsg2+llvm-0ubuntu1~16.04.1vulnerable
Ubunturustcpro1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1vulnerable
Ubunturustcpro1.36.0+dfsg1+llvm-2ubuntu1~16.04.1vulnerable
Ubunturustcpro1.37.0+dfsg1+llvm-1ubuntu1~16.04.1vulnerable
Ubunturustcpro1.39.0+dfsg1+llvm-3ubuntu1~16.04.1vulnerable
Ubunturustcpro1.41.0+dfsg1+llvm-0ubuntu1~16.04.1vulnerable
Ubunturustcpro1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1vulnerable
Ubunturustcpro1.47.0+dfsg1+llvm-1ubuntu1~16.04.1vulnerable
Ubunturustcpro1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2vulnerable
Ubunturustc20.041.37.0+dfsg1+llvm-1ubuntu1vulnerable
Ubunturustc20.041.38.0+dfsg0.2+llvm-0ubuntu1vulnerable
Ubunturustc20.041.38.0+dfsg0.2+llvm-0ubuntu2vulnerable
Ubunturustc20.041.39.0+dfsg1+llvm-3ubuntu1vulnerable
Ubunturustc20.041.40.0+dfsg1+llvm-5ubuntu1vulnerable
Ubunturustc20.041.41.0+dfsg1+llvm-0ubuntu1vulnerable
Ubunturustc20.041.41.0+dfsg1+llvm-0ubuntu2vulnerable
Ubunturustc20.041.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1vulnerable
Ubunturustc20.041.47.0+dfsg1+llvm-1ubuntu1~20.04.1vulnerable
Ubunturustc20.041.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2vulnerable
Ubunturustc20.041.53.0+dfsg1+llvm-4ubuntu1~20.04.1fixed
Ubunturustc22.041.51.0+dfsg1+llvm-1~exp3ubuntu1vulnerable
Ubunturustc22.041.53.0+dfsg1+llvm-4ubuntu1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrustcsourcesid1.53.0+dfsg1-1not yet assignedNot reported[986803]
Debianrustcsourceforky1.53.0+dfsg1-1not yet assignedNot reported[986803]
Debianrustcsourcetrixie1.53.0+dfsg1-1not yet assignedNot reported[986803]
Debianrustcsourcebookworm1.53.0+dfsg1-1not yet assignedNot reported[986803]
Ubunturustcdeb20.041.53.0+dfsg1+llvm-4ubuntu1~20.04.1Not reportedUBUNTU-CVE-2021-28878Not reported
Ubunturustcdeb22.041.53.0+dfsg1+llvm-4ubuntu1Not reportedUBUNTU-CVE-2021-28878Not reported

[Debian bug #986803]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libstd-rust-1.63]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · amd64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · arm64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [libstd-rust-dev]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · amd64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · arm64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [libstd-rust-dev-wasm32]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [libstd-rust-dev-windows]Fixed

    Source package: [rustc]

    Details (1)

    • 1.63.0+dfsg1-2 · amd64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rust-all]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rustc]Fixed
    Details (2)

    • 1.63.0+dfsg1-2 · amd64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · arm64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rust-clippy]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · amd64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · arm64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rust-doc]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rustfmt]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · amd64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · arm64 · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rust-gdb]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rust-lldb]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

  • [rust-src]Fixed

    Source package: [rustc]

    Details (2)

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

    • 1.63.0+dfsg1-2 · all · bookworm

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · bookworm; dsa · rustc · debian · 12

[Debian 13 (Trixie)]

  • [cargo]Fixed

    Source package: [rustc]

    Details (4)

    • 1.85.0+dfsg3-1 · amd64 · trixie

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.85.0+dfsg3-1 · arm64 · trixie

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.94.1+dfsg1-1~bpo13+3 · amd64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.94.1+dfsg1-1~bpo13+3 · arm64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

  • [cargo-doc]Fixed

    Source package: [rustc]

    Details (20)

    • 1.85.0+dfsg3-1 · all · trixie

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.85.0+dfsg3-1 · all · trixie

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.86.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.86.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.87.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.87.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.88.0+dfsg1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.88.0+dfsg1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.89.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.89.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.90.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.90.0+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.91.1+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.91.1+dfsg1-1~bpo13+2 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.92.0+dfsg1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.92.0+dfsg1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.93.1+dfsg1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.93.1+dfsg1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.94.1+dfsg1-1~bpo13+3 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.94.1+dfsg1-1~bpo13+3 · all · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

  • [libstd-rust-1.85]Fixed

    Source package: [rustc]

    Details (2)

    • 1.85.0+dfsg3-1 · amd64 · trixie

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.85.0+dfsg3-1 · arm64 · trixie

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

  • [libstd-rust-1.86]Fixed

    Source package: [rustc]

    Details (2)

    • 1.86.0+dfsg1-1~bpo13+2 · amd64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.86.0+dfsg1-1~bpo13+2 · arm64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

  • [libstd-rust-1.87]Fixed

    Source package: [rustc]

    Details (2)

    • 1.87.0+dfsg1-1~bpo13+2 · amd64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.87.0+dfsg1-1~bpo13+2 · arm64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

  • [libstd-rust-1.88]Fixed

    Source package: [rustc]

    Details (2)

    • 1.88.0+dfsg1-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.88.0+dfsg1-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

  • [libstd-rust-1.89]Fixed

    Source package: [rustc]

    Details (2)

    • 1.89.0+dfsg1-1~bpo13+2 · amd64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.89.0+dfsg1-1~bpo13+2 · arm64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

  • [libstd-rust-1.90]Fixed

    Source package: [rustc]

    Details (2)

    • 1.90.0+dfsg1-1~bpo13+2 · amd64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

    • 1.90.0+dfsg1-1~bpo13+2 · arm64 · trixie-backports

      Fixed · Fixed: 1.53.0+dfsg1-1

      dsa · rustc · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]