[CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1

[Micah Kornfield <emkornfield () apache org>]

The Apache Arrow project would like to hereby disclose that our 0.15.1
release patches two uninitialized memory bugs (CVE-2019-12408 and
CVE-2019-12410) in the the C++ implementation (which in turn can affect,
Python, Ruby and R).  In both cases there is a potential vulnerability
where data in memory can be unintentionally shared if Arrow Arrays are
transmitted over the wire (for instance with Flight) or persisted in the
streaming IPC and file formats.  Neither bug affects data persisted to the
Apache Parquet file format.


The first issue (CVE-2019-12408) affected ArrayBuilder classes in 0.14.0
and 0.14.1 releases.  In some cases arrays with null values could be built
using uninitialized memory for their data segment.


The second bug (CVE-2019-12410) affected Apache Arrow versions since at
least 0.12.0.  The bug left data read from Apache Parquet files with RLE
null encoded data uninitialized.


It is recommended that users upgrade to 0.15.1 as soon as possible and
audit any data that has been persisted in the Arrow IPC format or the Arrow
File Format.