Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-mp6r-fgw2-rxfx

Опубликовано: 25 авг. 2021
Источник: github
Github: Прошло ревью
CVSS3: 9.8

Описание

Arbitrary return types in xcb

The function xcb::xproto::GetPropertyReply::value() returns a slice of type T where T is an unconstrained type parameter. The raw bytes received from the X11 server are interpreted as the requested type. The users of the xcb crate are advised to only call this function with the intended types. These are u8, u16, and u32.

This issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/95

Пакеты

Наименование

xcb

rust
Затронутые версииВерсия исправления

< 1.0.0

1.0.0

EPSS

Процентиль: 66%
0.00504
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-657

Связанные уязвимости

CVSS3: 9.8
ubuntu
почти 5 лет назад

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.

CVSS3: 9.8
nvd
почти 5 лет назад

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.

CVSS3: 9.8
debian
почти 5 лет назад

An issue was discovered in the xcb crate through 2021-02-04 for Rust. ...

EPSS

Процентиль: 66%
0.00504
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-657