radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PNXNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PNXNUM count but several consumers still iterated with the original ephnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with ephnum = 0xffff and a much smaller resolved count in shdr[0].shinfo. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function rcorebinload of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: before <5.9.9.
A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component.
An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the bfdiv function.
radare2 5.8.9 has an out-of-bounds read in rbinobjectsetitems in libr/bin/bobj.c, causing a crash in rreadle32 in libr/include/rendian.h.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the printinsn32 function of libr/arch/p/nds32/nds32-dis.h.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the printinsn32fpu function of libr/arch/p/nds32/nds32-dis.h.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
A heap buffer overflow in vaxopfunction in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in rsleb128 function in radare2 5.4.2 and 5.4.0.
A use after free in rreggetnameidx function in radare2 5.4.2 and 5.4.0.
A null pointer deference in coreanalfcn function in radare2 5.4.2 and 5.4.0.
A use after free in rregsetvalue function in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in rreadle32 function in radare25.4.2 and 5.4.0.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Radare2 has a use-after-free vulnerability in pyc parser's getnoneobject function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.
Radare2 has a division by zero vulnerability in Mach-O parser's rebasebuffer function. This allow attackers to create malicious inputs that can cause denial of service.
Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasmdis at p/wasm/wasm.c.
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
A heap buffer overflow vulnerability in the rasmswfdisass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary code or carry out denial of service (DOS) attacks.
In radare2 before 3.9.0, a command injection vulnerability exists in binsymbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
In radare2 prior to 3.1.1, coreanalbytes in libr/core/cmdanal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.
In radare2 prior to 3.1.1, rbindyldcacheextract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting an input file.
In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asmx86nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file, a related issue to CVE-2018-20455.
In radare2 through 3.1.3, the assemble function inside libr/asm/p/asmarmcs.c allows attackers to cause a denial-of-service (application crash via an rnumcalc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20459.
In radare2 through 3.1.3, the armassassemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asmx86nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.