Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-26955: Rust's xcb Library Fails to Validate X Server Data
CVE-2021-26955 · published 5 years ago
Summary
The xcb library for Rust has a bug that can cause a security issue. This bug can lead to a program crashing or behaving unexpectedly if it receives malformed data from an X server. To fix this issue, update to a version of the xcb library that is not vulnerable, as of February 2021.
What to do
- Update rtbo xcb to version 1.0.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | rtbo | xcb |
< 1.0.0 Fix: upgrade to 1.0.0
|
| – | xcb_project | xcb |
<= 2021-02-04 cpe:2.3:a:xcb_project:xcb:*:*:*:*:*:rust:*:* |
Original advisory text
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated...
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-252Unchecked Return Value
Timeline
Published9 Feb 2021
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta