GHSA-jqpv-jm4m-86j9
Use After Free in libpulse-binding
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | libpulse-binding | < 1.2.1 | 1.2.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Affected versions contained a pair of use-after-free issues with the objects returned by the get_format_info and get_context methods of Stream objects. These objects were mistakenly being constructed without setting an important flag to prevent destruction of the underlying C objects they reference upon their own destruction.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/jnqnfe/pulse-binding-rust/security/advisories/GHSA-ghpq-vjxw-ch5w
- https://nvd.nist.gov/vuln/detail/CVE-2018-25028
- https://github.com/jnqnfe/pulse-binding-rust
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2018-0021.md
- https://rustsec.org/advisories/RUSTSEC-2018-0021.html