PT-2025-35525 · Crates.Io · Xcb

Publicado 2025-08-22 · Atualizado 2025-08-22

OSV

CVSS v4.0

1.7

Baixa

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.

Starting in version 1.6.0, xcb provides Connection::connect with fd and Connection::connect with fd and extensions as safe alternatives and deprecates the problematic functions.

Correção

Enumeração de Fraquezas

CWE-666

CWE-672

Identificadores relacionados

GHSA-655H-HG88-5QMF

Produtos afetados

Xcb

Referências · 8

• https://github.com/rustsec/advisory-db/pull/2355 · Nota
• https://github.com/rust-x-bindings/rust-xcb/issues/282 · Nota
• https://github.com/rust-x-bindings/rust-xcb/commit/da830976870c1174e3b33eb0643177be3991c002 · Nota
• https://github.com/rust-x-bindings/rust-xcb/issues/167 · Nota
• https://github.com/rust-x-bindings/rust-xcb/pull/283 · Nota
• https://github.com/rust-x-bindings/rust-xcb · Nota
• https://rustsec.org/advisories/RUSTSEC-2025-0051.html · Nota
• https://osv.dev/vulnerability/GHSA-655h-hg88-5qmf · Aviso do Fabricante