CVE-2019-13351

posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which can result in unintended information disclosure, crashes, or file corruption due to having the wrong file associated with the file descriptor.

References

Affected packages

Git / github.com/jackaudio/jack2

Affected ranges

Type

GIT

Repo

https://github.com/jackaudio/jack2

Events

Introduced

6c6cb46f5e66bb1b3f16beb9d7ad829bc0252509

Last affected

c1647819eed6d11f94b21981d9c869629299f357

Database specific

{
    "versions": [
        {
            "introduced": "1.9.1"
        },
        {
            "last_affected": "1.9.12"
        }
    ]
}

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.1.7"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13351.json"