GHSA-6xfj-hhwh-r3c2: Buffer Overflow
First published: Tue Apr 01 2025(Updated: )
A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convert_zip_date_time of the file zip.rs. The manipulation of the argument month leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.4.0 is able to address this issue. It is recommended to upgrade the affected component.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rust/ouch | <0.4.0 | 0.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2024-13941
- https://github.com/ouch-org/ouch/issues/707
- https://github.com/rustsec/advisory-db/pull/2084/files
- https://github.com/ouch-org/ouch/releases/tag/0.4.0
- https://github.com/user-attachments/files/16767988/ouch.crash.report.docx
- https://vuldb.com/?ctiid.302055
- https://vuldb.com/?id.302055
- https://vuldb.com/?submit.524511
- https://github.com/advisories/GHSA-6xfj-hhwh-r3c2 (Advisory)
Frequently Asked Questions
What is the severity of GHSA-6xfj-hhwh-r3c2?
The severity of GHSA-6xfj-hhwh-r3c2 is classified as critical.
How do I fix GHSA-6xfj-hhwh-r3c2?
To fix GHSA-6xfj-hhwh-r3c2, upgrade the ouch package to version 0.4.0 or later.
What type of vulnerability is GHSA-6xfj-hhwh-r3c2?
GHSA-6xfj-hhwh-r3c2 is a memory corruption vulnerability.
Where in the code is GHSA-6xfj-hhwh-r3c2 located?
GHSA-6xfj-hhwh-r3c2 is located in the function ouch::archive::zip::convert_zip_date_time in the file zip.rs.
Is local access required to exploit GHSA-6xfj-hhwh-r3c2?
Yes, the exploitation of GHSA-6xfj-hhwh-r3c2 requires local access.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6xfj-hhwh-r3c2
- alias/CVE-2024-13941
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/source
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/type
- agent/first-publish-date
- agent/event
- package-manager/rust