PT-2019-16429 · Rust · Libpulse-Binding

Publicado 2019-03-10 · Atualizado 2022-01-06 · CVE-2019-25055

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libpulse-binding crate versions prior to 2.6.0

Description An issue was discovered in the libpulse-binding crate where it mishandles a panic that crosses a Foreign Function Interface (FFI) boundary. The affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of undefined behavior (UB).

Recommendations For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of callbacks that cross FFI boundaries until a patch is available.

Correção

Enumeração de Fraquezas

CWE-248

Identificadores relacionados

CVE-2019-25055

GHSA-WCXC-JF6C-8RX9

GHSA-XVCG-2Q82-R87J

RUSTSEC-2019-0038

Produtos afetados

Libpulse-Binding

Referências · 10

• https://github.com/jnqnfe/pulse-binding-rust · Nota
• https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494 · Nota
• https://crates.io/crates/libpulse-binding · Nota
• https://osv.dev/vulnerability/GHSA-xvcg-2q82-r87j · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-25055 · Nota de Segurança
• https://osv.dev/vulnerability/RUSTSEC-2019-0038 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wcxc-jf6c-8rx9 · Aviso do Fabricante
• https://rustsec.org/advisories/RUSTSEC-2019-0038.html · Correção
• https://osv.dev/vulnerability/CVE-2019-25055 · Aviso do Fabricante
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2019-0038.md · Nota