CVE-2018-14017: Input Validation

Published Jul 12, 2018

Updated

The rbinjavaannotationnew function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in rbinjavalinenumbertableattrnew.

Affected Software

1 affected component

Radare Radare2=2.7.0

Remediation

Patch Available

https://github.com/radareorg/radare2/commit/e9ce0d64faf19fa4e9c260250fbdf25e3c11e152

Event History

Jul 12, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-14017?

CVE-2018-14017 has been classified as a denial of service vulnerability due to a heap-based buffer over-read.

How do I fix CVE-2018-14017?

To fix CVE-2018-14017, update radare2 to a version later than 2.7.0 that includes the relevant security patches.

Who is affected by CVE-2018-14017?

CVE-2018-14017 affects users of radare2 version 2.7.0.

What causes CVE-2018-14017?

CVE-2018-14017 is caused by missing input validation in the r_bin_java_line_number_table_attr_new function when processing crafted .class files.

What types of attacks can exploit CVE-2018-14017?

CVE-2018-14017 can be exploited by remote attackers to cause application crashes and denial of service.