RUSTSEC-2018-0020PublishedWithdrawn

An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2018-25001

Published

An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.

Source published: 31 Dec 2020 08:33:31 UTC
Source modified: 5 Aug 2024 12:26:39 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

euvd · EUVD-2021-1599

Published

An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Dec 31, 2020, 8:33:31 AM

dateUpdated: Aug 5, 2024, 12:26:39 PM

Source published: Dec 31, 2020, 8:33:31 AM (timezone not stated)
Source modified: Aug 5, 2024, 12:26:39 PM (timezone not stated)
Observed here: 9 Nov 2026 18:15:41 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

nvd · CVE-2018-25001

Published

An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-416

Original publisher date fields

published: 2020-12-31T10:15:13.020

lastModified: 2026-06-17T01:54:30.383

1 source CPE criteria · context only

cpe:2.3:a:libpulse-binding_project:libpulse-binding:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 31 Dec 2020 10:15:13 UTC
Source modified: 17 Jun 2026 01:54:30 UTC
Observed here: 24 Oct 2026 15:17:10 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Primary · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS 2.0 · [email protected] · Primary · 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

osv · GHSA-6gvc-4jvj-pwq4

Withdrawn

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f56g-chqp-22m9. This link is maintained to preserve external references. ## Original Description An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.

Source published: 30 Aug 2021 16:22:34 UTC
Source modified: 3 Feb 2026 03:08:54 UTC
Observed here: 24 Oct 2026 13:19:54 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Publisher rating · MODERATE

osv · GHSA-f56g-chqp-22m9

Published

### Overview Version 2.5.0 of the `libpulse-binding` Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a `proplist::Iterator` to the `Proplist` object for which it was created. This made it possible for users, without experiencing a compiler error/warning, to destroy the `Proplist` object before the iterator, thus destroying the underlying C object the iterator works upon, before the iterator may be finished with it. This advisory is being written retrospectively, having previously only been noted in the changelog. No CVE assignment was sought. This impacts all versions of the crate before 2.5.0 back to 1.0.5. Before version 1.0.5 the function that produces the iterator was broken to the point of being useless. ### Patches Users are required to update to version 2.5.0 or newer. Versions older than 2.5.0 have been yanked from crates.io as of the 22nd of October 2020.

Source published: 3 Feb 2024 00:28:45 UTC
Source modified: 3 Feb 2026 03:08:51 UTC
Observed here: 24 Oct 2026 13:19:54 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Publisher rating · MODERATE

osv · RUSTSEC-2018-0020

Published

Affected versions contained a possible use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a `proplist::Iterator` to the `Proplist` object for which it was created. This made it possible for users, without experiencing a compiler error/warning, to destroy the `Proplist` object before the iterator, thus destroying the underlying C object the iterator works upon, before the iterator may be finished with it. This impacts all versions of the crate before `2.5.0` back to `1.0.5`. Before version `1.0.5` the function that produces the iterator was broken to the point of being useless.

Source published: 22 Dec 2018 12:00:00 UTC
Source modified: 12 Oct 2026 18:00:04 UTC
Observed here: 24 Oct 2026 13:19:54 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N