GHSA-wcxc-jf6c-8rx9 CVE-2019-25055 GHSA-xvcg-2q82-r87j RUSTSEC-2019-0038
Duplicate Advisory: Uncaught Exception in libpulse-binding
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.22%
- Chance of exploitation in the next 30 days. Higher than 68.60% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-248 Uncaught Exception
- Fix
2.6.0- Upgrade libpulse-binding to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xvcg-2q82-r87j. This link is maintained to preserve external references.
Original Description
Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB. This flaw was corrected by [this commit][1] which was included in version 2.6.0.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| libpulse-binding | < 2.6.0 |
2.6.0 |
| libpulse-binding | >= 0.0.0-0, < 2.6.0 |
2.6.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
libpulse-binding crates.io → 2.6.0
- cargo
cargo update -p libpulse-binding --precise 2.6.0
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6gvc-4jvj-pwq4 Duplicate Advisory: Use after free in libpulse-binding | Medium | Also affects libpulse-binding |
| GHSA-jqpv-jm4m-86j9 Use after free in libpulse-binding | High | Also affects libpulse-binding |
| GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message | High | Same weakness, CWE-248 |
| GHSA-27r3-jxmh-p828 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body | High | Same weakness, CWE-248 |
| GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type | Medium | Same weakness, CWE-248 |
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor | High | Same weakness, CWE-248 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation | High | Same weakness, CWE-248 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings | High | Same weakness, CWE-248 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor