CVE-2019-14745: Command Injection
In radare2 before 3.7.0, a command injection vulnerability exists in binsymbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14745?
CVE-2019-14745 is classified as a high-severity vulnerability due to the potential for arbitrary command execution.
How do I fix CVE-2019-14745?
To mitigate CVE-2019-14745, upgrade radare2 to version 3.7.0 or later.
What is the impact of CVE-2019-14745?
The impact of CVE-2019-14745 allows an attacker to execute arbitrary shell commands with the privileges of the user running radare2.
Which versions of radare2 are affected by CVE-2019-14745?
CVE-2019-14745 affects all versions of radare2 before 3.7.0.
Can CVE-2019-14745 be exploited through crafted executable files?
Yes, CVE-2019-14745 can be exploited by using crafted executable files that leverage the command injection vulnerability.