pie-flavor/hexchat-rs · Security
hexchat crate has a Use After Free vulnerability
- GHSA ID
- GHSA-x43w-ph7m-pfjx
- Severity
- high
- Published
- Updated
- CVSS v4
- 7.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Description
All versions of this crate have function deregister_command which can result in use after free. This is unsound.
In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads.
In addition, the hexchat crate is no longer actively maintained. If users rely on this crate, consider switching to an alternative.
CWEs
- CWE-416 · Use After Free