GHSA-3fg9-hcq5-vxrc: iana-time-zone vulnerable to use after free in MacOS / iOS implementation

August 30, 2022

In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.

The copied system time zone was released before its name was copied. If the system time zone was changed between the call of CFRelease and str::to_owned(), random memory would be copied.

References

github.com/advisories/GHSA-3fg9-hcq5-vxrc
github.com/strawlab/iana-time-zone
github.com/strawlab/iana-time-zone/pull/54
rustsec.org/advisories/RUSTSEC-2022-0049.html

Detect and mitigate GHSA-3fg9-hcq5-vxrc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →