RUSTSEC-2020-0071: Potential segfault in the time crate

> Potential segfault in the time crate

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `time` |
| Version | `0.1.45` |
| URL | [https://github.com/time-rs/time/issues/293](https://github.com/time-rs/time/issues/293) |
| Date | 2020-11-18 |
| Patched versions | `>=0.2.23` |
| Unaffected versions | `=0.2.0,=0.2.1,=0.2.2,=0.2.3,=0.2.4,=0.2.5,=0.2.6` |

### Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

- `time::UtcOffset::local_offset_at`
- `time::UtcOffset::try_local_offset_at`
- `time::UtcOffset::current_local_offset`
- `time::UtcOffset::try_current_local_offset`
- `time::OffsetDateTime::now_local`
- `time::OffsetDateTime::try_now_local`

The affected functions in time 0.1 (all versions) are:

- `at`
- `at_utc`
- `now`

Non-Unix targets (including Windows and wasm) are unaffected.

### Patches

Pending a proper fix, the internal method that determines the local offset has been modified to always return `None` on the affected operating systems. This has the effect of returning an `Err` on the `try_*` methods and `UTC` on the non-`try_*` methods.

Users and library authors with time in their dependency tree should perform `cargo update`, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3 series.

### Workarounds

No workarounds are known.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2020-0071.html) for additional details.