PT-2024-40036 · Ouch · Ouch

Published 2024-09-23 · Updated 2024-09-23

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ouch (affected versions not specified)

Description The issue arises when attempting to decompress a file using ouch. It involves reaching the function ouch::archive::zip::convert zip date time, which contains an unsafe function, transmute. This transmute function is used to convert the type of the month object, resulting in its address being changed to an uninitialized memory region. Subsequently, when another function attempts to dereference month, a segmentation fault occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-2WQ5-G96F-MV3V

Affected Products

Ouch

References · 4

• https://osv.dev/vulnerability/GHSA-2wq5-g96f-mv3v · Vendor Advisory
• https://github.com/ouch-org/ouch/issues/707 · Note
• https://github.com/ouch-org/ouch · Note
• https://rustsec.org/advisories/RUSTSEC-2024-0374.html · Note