OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-02-23 15:38:27 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
76c37849b60cf981b0bbffd5877dec12046d9414
advisory-db/crates/portaudio/RUSTSEC-2016-0003.md
Alexis Mousset 84c633df9c Update aliases from GHSA OSV export (#1693)
2023-06-13 15:10:24 +02:00

556 B
Raw Blame History 

[advisory]
id = "RUSTSEC-2016-0003"
package = "portaudio"
aliases = ["CVE-2016-10933", "GHSA-pq6v-x7gp-7776"]
cvss = "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
date = "2016-08-01"
keywords = ["ssl", "mitm"]
url = "https://github.com/RustAudio/rust-portaudio/issues/144"

[versions]
patched = []

HTTP download and execution allows MitM RCE

The build script in the portaudio crate will attempt to download via HTTP the portaudio source and build it.

A Mallory in the middle can intercept the download with their own archive and get RCE.