MEDIUM

GHSA-3fg9-hcq5-vxrc

iana-time-zone vulnerable to use after free in MacOS / iOS implementation

Details

In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.

The copied system time zone was released before its name was copied. If the system time zone was changed between the call of `CFRelease` and `str::to_owned()`, random memory would be copied.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/iana-time-zone

Introduced in: 0.1.43Fixed in: 0.1.45

Upgrade iana-time-zone to 0.1.45 or newer (ecosystem crates.io).

References

https://github.com/strawlab/iana-time-zone/pull/54[WEB]
https://github.com/strawlab/iana-time-zone[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2022-0049.html[WEB]