CVE-2018-11383: Medium severity radare2 vulnerability
Published May 22, 2018
·Updated
The rstrbuffini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/analavr.c.
Affected Software
1 affected component
Radare Radare2=2.5.0
Remediation
Event History
May 22, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-11383?
CVE-2018-11383 has a severity rating that allows remote attackers to crash the application due to a denial of service.
2
How do I fix CVE-2018-11383?
To fix CVE-2018-11383, update to a version of radare2 higher than 2.5.0 that addresses this vulnerability.
3
What kind of attack does CVE-2018-11383 facilitate?
CVE-2018-11383 facilitates a denial of service attack through the exploitation of an uninitialized variable in the CPSE handler.
4
Which version of radare2 is affected by CVE-2018-11383?
CVE-2018-11383 specifically affects radare2 version 2.5.0.
5
Can CVE-2018-11383 be exploited remotely?
Yes, CVE-2018-11383 can be exploited remotely by using a crafted ELF file.