PT-2025-35525 · Crates.Io · Xcb

Published 2025-08-22 · Updated 2025-08-22

OSV

CVSS v4.0

1.7

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.

Starting in version 1.6.0, xcb provides Connection::connect with fd and Connection::connect with fd and extensions as safe alternatives and deprecates the problematic functions.

Fix

Weakness Enumeration

CWE-666

CWE-672

Related Identifiers

GHSA-655H-HG88-5QMF

Affected Products

Xcb

References · 8

• https://osv.dev/vulnerability/GHSA-655h-hg88-5qmf · Vendor Advisory
• https://github.com/rustsec/advisory-db/pull/2355 · Note
• https://github.com/rust-x-bindings/rust-xcb/issues/282 · Note
• https://github.com/rust-x-bindings/rust-xcb/commit/da830976870c1174e3b33eb0643177be3991c002 · Note
• https://github.com/rust-x-bindings/rust-xcb/issues/167 · Note
• https://github.com/rust-x-bindings/rust-xcb/pull/283 · Note
• https://github.com/rust-x-bindings/rust-xcb · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0051.html · Note