CVE-2019-16718: OS Command Injection
In radare2 before 3.9.0, a command injection vulnerability exists in binsymbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16718?
CVE-2019-16718 is classified as a critical vulnerability due to its potential for command injection.
How do I fix CVE-2019-16718?
To remediate CVE-2019-16718, upgrade to radare2 version 3.9.0 or later.
What are the potential impacts of CVE-2019-16718?
Exploiting CVE-2019-16718 could allow an attacker to execute arbitrary shell commands with the victim's permissions.
Which versions of radare2 are affected by CVE-2019-16718?
CVE-2019-16718 affects all radare2 versions prior to 3.9.0.
Is CVE-2019-16718 related to any previous vulnerabilities?
Yes, CVE-2019-16718 is a result of an insufficient fix for CVE-2019-14745.