CVE-2019-12829 — Out-of-bounds Write in Radare2

CWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 26.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Radare2Radare Radare2
Timeline
PublishedJun 15
Latest updateMay 24

Description

radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶debiandebian/radare2< radare2 3.8.0+dfsg-1 (sid)
▶NVDradare/radare23.5.1

🔴Vulnerability Details

1
GHSA
GHSA-j3xv-hxjv-fw3q: radare2 through 3↗2022-05-24
▶

📋Vendor Advisories

1
Debian
CVE-2019-12829: radare2 - radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers t...↗2019
▶