{"id":"CVE-2019-25055","aliases":["EUVD-2022-0748","GHSA-wcxc-jf6c-8rx9","GHSA-xvcg-2q82-r87j","RUSTSEC-2019-0038"],"status":"published","title":"Duplicate Advisory: Uncaught Exception in libpulse-binding","description":"An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01216,"percentile":0.68802,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2019-03-10T12:00:00Z","modified":"2026-10-24T10:30:42Z","fixes":[{"ecosystem":"crates.io","package":"libpulse-binding","fixed_in":["2.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"libpulse-binding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libpulse-binding","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libpulse-binding","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.6.0"}]}]}],"products":[{"vendor":"libpulse-binding_project","product":"libpulse-binding"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2019-0038.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","advisory"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2019-0038.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wcxc-jf6c-8rx9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25055","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvcg-2q82-r87j"},{"url":"https://github.com/jnqnfe/pulse-binding-rust","tags":["package"]},{"url":"https://crates.io/crates/libpulse-binding","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-25055","description":"An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.","status":"published","published":"2021-12-26T21:54:23Z","modified":"2024-08-05T03:00:19.038Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2022-0748","description":"An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.","status":"published","published":"2021-12-26T21:54:23Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-xvcg-2q82-r87j","title":"Panic mishandled in libpulse-binding","description":"An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.","status":"published","published":"2022-01-06T22:18:19Z","modified":"2026-01-23T22:33:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:39:19.525691Z"},{"id":"GHSA-wcxc-jf6c-8rx9","title":"Duplicate Advisory: Uncaught Exception in libpulse-binding","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xvcg-2q82-r87j. This link is maintained to preserve external references.\n\n## Original Description\nAffected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which\nis a form of UB. This flaw was corrected by [this commit][1] which was included in version 2.6.0.","status":"withdrawn","published":"2021-08-25T20:57:21Z","modified":"2026-01-23T22:32:52Z","cwes":["CWE-248"],"updated_at":"2026-11-02T14:39:19.525691Z"}],"nvd":[{"id":"CVE-2019-25055","description":"An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.","status":"published","published":"2021-12-27T00:15:08.24Z","modified":"2026-06-17T02:31:34.04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:49.099942Z"}],"osv":[{"id":"CVE-2019-25055","description":"An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.","status":"published","published":"2021-12-27T00:15:08.24Z","modified":"2026-10-24T10:30:42.674217052Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"GHSA-xvcg-2q82-r87j","title":"Panic mishandled in libpulse-binding","description":"An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.","status":"published","published":"2022-01-06T22:18:19Z","modified":"2026-02-03T03:08:21.584811Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"GHSA-wcxc-jf6c-8rx9","title":"Duplicate Advisory: Uncaught Exception in libpulse-binding","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xvcg-2q82-r87j. This link is maintained to preserve external references.\n\n## Original Description\nAffected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which\nis a form of UB. This flaw was corrected by [this commit][1] which was included in version 2.6.0.","status":"withdrawn","published":"2021-08-25T20:57:21Z","modified":"2026-02-03T03:08:22.920385Z","cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"RUSTSEC-2019-0038","title":"Fix for UB in failure to catch panics crossing FFI boundaries","description":"Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which\nis a form of UB. This flaw was corrected by [this commit][1] which was included in version 2.6.0.\n\n[1]: https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494","status":"published","published":"2019-03-10T12:00:00Z","modified":"2023-11-08T04:01:32.736309Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}