PT-2019-16429 · Rust · Libpulse-Binding

Published 2019-03-10 · Updated 2022-01-06 · CVE-2019-25055

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libpulse-binding crate versions prior to 2.6.0

Description An issue was discovered in the libpulse-binding crate where it mishandles a panic that crosses a Foreign Function Interface (FFI) boundary. The affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of undefined behavior (UB).

Recommendations For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of callbacks that cross FFI boundaries until a patch is available.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2019-25055

GHSA-WCXC-JF6C-8RX9

GHSA-XVCG-2Q82-R87J

RUSTSEC-2019-0038

Affected Products

Libpulse-Binding

References · 10

• https://osv.dev/vulnerability/GHSA-xvcg-2q82-r87j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25055 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2019-0038 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wcxc-jf6c-8rx9 · Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2019-0038.html · Patch
• https://osv.dev/vulnerability/CVE-2019-25055 · Vendor Advisory
• https://github.com/jnqnfe/pulse-binding-rust · Note
• https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494 · Note
• https://crates.io/crates/libpulse-binding · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2019-0038.md · Note