Use after free in libpulse-binding · CVE-2018-25001 · GitHub Advisory Database · GitHub

Use after free in libpulse-binding

Moderate severity GitHub Reviewed Published Aug 30, 2021 to the GitHub Advisory Database • Updated Feb 12, 2024

Package

libpulse-binding (Rust)

Affected versions

>= 1.0.5, < 2.5.0

Patched versions

2.5.0

Description

An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.

References

Published by the National Vulnerability Database

Dec 31, 2020

Reviewed Aug 26, 2021

Published to the GitHub Advisory Database Aug 30, 2021

Last updated Feb 12, 2024

Severity

Moderate

6.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N