CVE-2024-11858: Radare2: command injection via pebble application files in radare2
A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing
Other sources
The vulnerability in Radare2 affects versions up to and including 5.9.8. When processing malicious Pebble Application files, Radare2 improperly sanitizes user-controlled input, leading to command injection. This allows arbitrary shell commands to execute during file handling. The issue was confirmed in version 5.9.7 on Linux x86-64 and demonstrated with a Base64-encoded test file
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11858?
CVE-2024-11858 is classified as a command injection vulnerability due to insufficient input validation.
How do I fix CVE-2024-11858?
To fix CVE-2024-11858, update Radare2 to the latest version beyond 5.9.8 where the vulnerability has been addressed.
What software versions are affected by CVE-2024-11858?
CVE-2024-11858 affects all versions of Radare2 up to and including version 5.9.8.
What type of vulnerability is CVE-2024-11858?
CVE-2024-11858 is a command injection vulnerability that occurs during the parsing of Pebble Application files.
Can CVE-2024-11858 lead to remote code execution?
Yes, CVE-2024-11858 can potentially lead to remote code execution through the injection of shell commands.