The Apache Arrow project would like to hereby disclose that our 0.15.1 release patches two uninitialized bugs (CVE-2019-12408 and CVE-2019-12410) in the the C++ implementation (which in turn can affect, Python, Ruby and R). In both cases there is a potential vulnerability where data in memory can be unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats. Neither bug affects data persisted to the Apache Parquet file format.
The first issue (CVE-2019-12408) affected ArrayBuilder classes in 0.14.0 and 0.14.1 releases. In some cases arrays with null values could be built using uninitialized memory for their data segment. The second bug (CVE-2019-12410) affected Apache Arrow versions since at least 0.12.0. The bug left data read from Apache Parquet files with RLE null encoded data uninitialized. It is recommended that users upgrade to 0.15.1 as soon as possible and audit any data that has been persisted in the Arrow IPC format or the Arrow File Format.
