Reported

March 10, 2019

Issued

October 25, 2020 (last modified: June 13, 2023)

Package

libpulse-binding (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Aliases

• CVE-2019-25055
• GHSA-wcxc-jf6c-8rx9
• GHSA-xvcg-2q82-r87j

References

• https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494

Patched

• >=2.6.0

Description

Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB. This flaw was corrected by this commit which was included in version 2.6.0.

Advisory available under CC0-1.0 license.