Threats tagged 'rustsec-2024-0351'

CVE-2024-35197 affects the gix-ref Git library on Windows systems, where references or file paths that match legacy Windows device names (e.g., CON, CONIN$, CONOUT$, COM1) can cause unintended device access. Cloning a malicious repository with such names can lead to indefinite blocking by reading from the console device or writing arbitrary attacker-controlled data to devices like the console or serial ports. This can result in denial of service or deceptive console messages that may facilitate social engineering. The vulnerability is fixed in gix-ref version 0.44.0.