Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yd3E1LWc5NmYtbXYzds4AA_un

Ouch! allows a segmentation fault due to use of uninitialized memory

When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convert_zip_date_time". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the uninitialized memory region. After that, when other function tries to dereference "month", segmentation fault occurs.

Permalink: https://github.com/advisories/GHSA-2wq5-g96f-mv3v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yd3E1LWc5NmYtbXYzds4AA_un
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 24 days ago
Updated: 24 days ago

Identifiers: GHSA-2wq5-g96f-mv3v
References:

• https://github.com/ouch-org/ouch/issues/707
• https://rustsec.org/advisories/RUSTSEC-2024-0374.html
• https://github.com/advisories/GHSA-2wq5-g96f-mv3v

Repository: https://github.com/ouch-org/ouch
Blast Radius: 1.0

Affected Packages