Debian Radare2 vulnerabilities

CVE-2022-1244 [MEDIUM] CVE-2022-1244: radare2 - heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This... heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2022-1284 [MEDIUM] CVE-2022-1284: radare2 - heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This ... heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2022-1444 [MEDIUM] CVE-2022-1444: radare2 - heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This ... heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2018-10186 [HIGH] CVE-2018-10186: radare2 - In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str fu... In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. This issue is different from CVE-2017-15368. Scope: local sid: resolved (fixed in 2.6.0+dfsg-1)

CVE-2022-1052 [MEDIUM] CVE-2022-1052: radare2 - Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/ra... Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2022-34502 [MEDIUM] CVE-2022-34502: radare2 - Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function... Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2025-63745 [MEDIUM] CVE-2025-63745: radare2 - A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and ear... A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data. Scope: local sid: resolved (fixed in 6.0.7+ds-1)

CVE-2025-63744 [MEDIUM] CVE-2025-63744: radare2 - A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and ear... A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program. Scope: local sid: resolved (fixed in 6.0.7+ds-1)

CVE-2017-6197 [MEDIUM] CVE-2017-6197: radare2 - The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote ... The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by the r_read_le32 function. Scope: local sid: resolved (fixed in 1.1.0+dfsg-2)

CVE-2017-9761 [MEDIUM] CVE-2017-9761: radare2 - The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attacker... The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. Scope: local sid: resolved (fixed in 1.6.0+dfsg-1)

CVE-2018-14015 [MEDIUM] CVE-2018-14015: radare2 - The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers ... The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c. Scope: local sid: resolved (fixed in 2.8.0+dfsg-1)

CVE-2018-14017 [MEDIUM] CVE-2018-14017: radare2 - The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 all... The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new. Scope: local sid: resolved (fixed in 2.8.0+dfsg-1)

CVE-2018-14016 [MEDIUM] CVE-2018-14016: radare2 - The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows r... The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Mini Crash Dump file. Scope: local sid: resolved (fixed in 2.8.0+dfsg-1)

CVE-2018-8810 [MEDIUM] CVE-2018-8810: radare2 - In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t ... In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_classes.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted Mach-O file. Scope: local sid: resolved (fixed in 2.6.0+dfsg-1)

CVE-2018-8809 [MEDIUM] CVE-2018-8809: radare2 - In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op functi... In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file. Scope: local sid: resolved (fixed in 2.6.0+dfsg-1)

CVE-2018-8808 [MEDIUM] CVE-2018-8808: radare2 - In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassembl... In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file. Scope: local sid: resolved (fixed in 2.6.0+dfsg-1)

CVE-2020-16269 [MEDIUM] CVE-2020-16269: radare2 - radare2 4.5.0 misparses DWARF information in executable files, causing a segment... radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section. Scope: local sid: resolved (fixed in 5.0.0+dfsg-1)

CVE-2018-19842 [MEDIUM] CVE-2018-19842: radare2 - getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to ... getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2. Scope: local sid: resolved (fixed in 3.1.0+dfsg-1)

CVE-2018-15834 [MEDIUM] CVE-2018-15834: radare2 - In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module... In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file. Scope: local sid: resolved (fixed in 2.9.0+dfsg-1)

CVE-2018-20459 [MEDIUM] CVE-2018-20459: radare2 - In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/arma... In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457. Scope: local sid: