Debian Radare2 vulnerabilities

CVE-2021-4021 [HIGH] CVE-2021-4021: radare2 - A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 an... A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2021-44974 [MEDIUM] CVE-2021-44974: radare2 - radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via li... radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2021-32613 [MEDIUM] CVE-2021-32613: radare2 - In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse v... In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS. Scope: local sid: resolved (fixed in 5.5.0+dfsg-1)

CVE-2021-44975 [MEDIUM] CVE-2021-44975: radare2 - radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_obj... radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser. Scope: local sid: resolved (fixed in 5.9.0+dfsg-1)

CVE-2020-27794 [CRITICAL] CVE-2020-27794: radare2 - A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successf... A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modification of unexpected memory locations and potentially causing a crash. Scope: local sid: resolved (fixed in 5.0.0+dfsg-1)

CVE-2020-17487 [HIGH] CVE-2020-17487: radare2 - radare2 4.5.0 misparses signature information in PE files, causing a segmentatio... radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY. Scope: local sid: resolved (fixed in 5.0.0+dfsg-1)

CVE-2020-27795 [HIGH] CVE-2020-27795: radare2 - A segmentation fault was discovered in radare2 with adf command. In libr/core/cm... A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_fcn_data (core, input + 1) --> RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1); returns null pointer for fcn causing segmentation fault later in ensure_fcn_range (fcn). Scope: local sid: resolved (fixed in

CVE-2020-15121 [HIGH] CVE-2020-15121: radare2 - In radare2 before version 4.5.0, malformed PDB file names in the PDB server path... In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory. Scope: local sid: resolved (fixed in 5.0.0+dfsg-1)

CVE-2020-27793 [HIGH] CVE-2020-27793: radare2 - An off-by-one overflow flaw was found in radare2 due to mismatched array length ... An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crash, and perform a denail of service attack. Scope: local sid: resolved (fixed in 5.0.0+dfsg-1)

CVE-2020-16269 [MEDIUM] CVE-2020-16269: radare2 - radare2 4.5.0 misparses DWARF information in executable files, causing a segment... radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section. Scope: local sid: resolved (fixed in 5.0.0+dfsg-1)

CVE-2019-12829 [HIGH] CVE-2019-12829: radare2 - radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers t... radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c. Scope: local sid: resolved (fixed in 3.8.0+dfsg-1)

CVE-2019-12802 [HIGH] CVE-2019-12802: radare2 - In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishan... In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar; invalid free in rcc_pusharg). Scope: local sid: resolved (fixed in 3.8.0+dfsg-1)

CVE-2019-19590 [HIGH] CVE-2019-19590: radare2 - In radare2 through 4.0, there is an integer overflow for the variable new_token_... In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly

CVE-2019-14745 [HIGH] CVE-2019-14745: radare2 - In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols... In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables. Scope: local sid: resolved (fixed in 3.9.0+dfsg-1)

CVE-2019-12790 [HIGH] CVE-2019-12790: radare2 - In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_la... In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c. Scope: local sid: resolved (fixed in 3.8.0+dfsg-1)

CVE-2019-19647 [HIGH] CVE-2019-19647: radare2 - radare2 through 4.0.0 lacks validation of the content variable in the function r... radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input. Scope: local sid: resolved (fixed in 4.2.1+dfsg-1)

CVE-2019-12865 [MEDIUM] CVE-2019-12865: radare2 - In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free f... In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command. Scope: local sid: resolved (fixed in 3.8.0+dfsg-1)

CVE-2019-16718 [HIGH] CVE-2019-16718: radare2 - In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols... In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables. Scope: loca

CVE-2018-14017 [MEDIUM] CVE-2018-14017: radare2 - The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 all... The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new. Scope: local sid: resolved (fixed in 2.8.0+dfsg-1)

CVE-2018-15834 [MEDIUM] CVE-2018-15834: radare2 - In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module... In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file. Scope: local sid: resolved (fixed in 2.9.0+dfsg-1)