radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PNXNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PNXNUM count but several consumers still iterated with the original ephnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with ephnum = 0xffff and a much smaller resolved count in shdr[0].shinfo. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function rcorebinload of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: before <5.9.9.
A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component.
An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the bfdiv function.
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
The sdbsetinternal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in rbindwarfparsecompunit in libr/bin/dwarf.c.
radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasmdis at p/wasm/wasm.c.
Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the printinsn32 function of libr/arch/p/nds32/nds32-dis.h.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the printinsn32fpu function of libr/arch/p/nds32/nds32-dis.h.
Radare2 has a division by zero vulnerability in Mach-O parser's rebasebuffer function. This allow attackers to create malicious inputs that can cause denial of service.
Radare2 has a use-after-free vulnerability in pyc parser's getnoneobject function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.
radare2 5.8.9 has an out-of-bounds read in rbinobjectsetitems in libr/bin/bobj.c, causing a crash in rreadle32 in libr/include/rendian.h.
A null pointer deference in coreanalfcn function in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in vaxopfunction in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in rsleb128 function in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in rreadle32 function in radare25.4.2 and 5.4.0.
A use after free in rreggetnameidx function in radare2 5.4.2 and 5.4.0.
A use after free in rregsetvalue function in radare2 5.4.2 and 5.4.0.
In radare 2.0.1, a pointer wraparound vulnerability exists in storeversioninfognuverdef() in libr/bin/format/elf/elf.c.
In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.
In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange() in libr/bin/bin.c when doing a string search.
The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call.
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asmx86nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file, a related issue to CVE-2018-20455.
In radare2 prior to 3.1.1, coreanalbytes in libr/core/cmdanal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.
In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file, related to rbindwarfparsecompunit in dwarf.c and sdbsetinternal in shlr/sdb/src/sdb.c.
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asmx86nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.