An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.
The product calls free() twice on the same memory address.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Smallvec | Servo | 0.3.2 (including) | 0.6.3 (excluding) |
| Rust-smallvec | Ubuntu | disco | * |
| Rust-smallvec | Ubuntu | eoan | * |
| Rust-smallvec | Ubuntu | focal | * |
| Rust-smallvec | Ubuntu | groovy | * |
| Rust-smallvec | Ubuntu | hirsute | * |
| Rust-smallvec | Ubuntu | impish | * |
| Rust-smallvec | Ubuntu | kinetic | * |
| Rust-smallvec | Ubuntu | lunar | * |
| Rust-smallvec | Ubuntu | mantic | * |
| Rust-smallvec | Ubuntu | oracular | * |
| Rust-smallvec | Ubuntu | trusty | * |