iana-time-zone vulnerable to use after free in MacOS / iOS implementation · GHSA-3fg9-hcq5-vxrc · GitHub Advisory Database · GitHub

iana-time-zone vulnerable to use after free in MacOS / iOS implementation

Moderate severity GitHub Reviewed Published Aug 30, 2022 to the GitHub Advisory Database • Updated Jan 12, 2023

Package

iana-time-zone (Rust)

Affected versions

>= 0.1.43, < 0.1.45

Patched versions

0.1.45

Description

In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.

The copied system time zone was released before its name was copied.
If the system time zone was changed between the call of CFRelease and str::to_owned(),
random memory would be copied.

References

Published to the GitHub Advisory Database Aug 30, 2022

Reviewed Aug 30, 2022

Last updated Jan 12, 2023