[CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1

[Micah Kornfield <em...@gmail.com>]

The Apache Arrow project would like to hereby disclose that our 0.15.1
release patches two uninitialized bugs (CVE-2019-12408 and CVE-2019-12410)
in the the C++ implementation (which in turn can affect, Python, Ruby and
R).  In both cases there is a potential vulnerability where data in memory
can be unintentionally shared if Arrow Arrays are transmitted over the wire
(for instance with Flight) or persisted in the streaming IPC and file
formats.  Neither bug affects data persisted to the Apache Parquet file
format.


The first issue (CVE-2019-12408) affected ArrayBuilder classes in 0.14.0
and 0.14.1 releases.  In some cases arrays with null values could be built
using uninitialized memory for their data segment.


The second bug (CVE-2019-12410) affected Apache Arrow versions since at
least 0.12.0.  The bug left data read from Apache Parquet files with RLE
null encoded data uninitialized.


It is recommended that users upgrade to 0.15.1 as soon as possible and
audit any data that has been persisted in the Arrow IPC format or the Arrow
File Format.