{"id":"GHSA-655h-hg88-5qmf","aliases":["RUSTSEC-2025-0051"],"status":"published","title":"Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety","description":"The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd` to be used as a socket connection. On either failure of these constructors or on the drop of `Connection`, it closes the associated file descriptor. Thus, a program which uses an `OwnedFd` (such as a `UnixStream`) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.\n\nStarting in version 1.6.0, `xcb` provides `Connection::connect_with_fd` and `Connection::connect_with_fd_and_extensions` as safe alternatives and deprecates the problematic functions.","severity":{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-666","CWE-672"],"published":"2025-08-05T12:00:00Z","modified":"2025-10-28T06:29:23Z","fixes":[{"ecosystem":"crates.io","package":"xcb","fixed_in":["1.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"xcb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"xcb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"xcb","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.6.0"}]}]}],"references":[{"url":"https://github.com/rust-x-bindings/rust-xcb/issues/167","tags":["web","report"]},{"url":"https://github.com/rust-x-bindings/rust-xcb/issues/282","tags":["web","report"]},{"url":"https://github.com/rust-x-bindings/rust-xcb/pull/283","tags":["web"]},{"url":"https://github.com/rustsec/advisory-db/pull/2355","tags":["web"]},{"url":"https://github.com/rust-x-bindings/rust-xcb/commit/da830976870c1174e3b33eb0643177be3991c002","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0051.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-655h-hg88-5qmf"},{"url":"https://github.com/rust-x-bindings/rust-xcb","tags":["package"]},{"url":"https://crates.io/crates/xcb","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-655h-hg88-5qmf","title":"Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety","description":"The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd` to be used as a socket connection. On either failure of these constructors or on the drop of `Connection`, it closes the associated file descriptor. Thus, a program which uses an `OwnedFd` (such as a `UnixStream`) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.\n\nStarting in version 1.6.0, `xcb` provides `Connection::connect_with_fd` and `Connection::connect_with_fd_and_extensions` as safe alternatives and deprecates the problematic functions.","status":"published","published":"2025-08-22T17:34:45Z","modified":"2025-08-22T17:34:47Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-666","CWE-672"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"osv":[{"id":"GHSA-655h-hg88-5qmf","title":"Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety","description":"The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd` to be used as a socket connection. On either failure of these constructors or on the drop of `Connection`, it closes the associated file descriptor. Thus, a program which uses an `OwnedFd` (such as a `UnixStream`) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.\n\nStarting in version 1.6.0, `xcb` provides `Connection::connect_with_fd` and `Connection::connect_with_fd_and_extensions` as safe alternatives and deprecates the problematic functions.","status":"published","published":"2025-08-22T17:34:45Z","modified":"2025-10-28T06:29:23.247912Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-666","CWE-672"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"RUSTSEC-2025-0051","title":"`xcb::Connection::connect_to_fd*` functions violate I/O safety","description":"The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd`\nto be used as a socket connection. On either failure of these constructors or\non the drop of `Connection`, it closes the associated file descriptor. Thus, a\nprogram which uses an `OwnedFd` (such as a `UnixStream`) as the file descriptor\ncan close the file descriptor and continue to attempt using it or close an\nalready-closed file descriptor, violating I/O safety.\n\nStarting in version 1.6.0, `xcb` provides `Connection::connect_with_fd` and\n`Connection::connect_with_fd_and_extensions` as safe alternatives and\ndeprecates the problematic functions.","status":"published","published":"2025-08-05T12:00:00Z","modified":"2025-10-28T06:29:23.247912Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}