Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: before <5.9.9.
Radare2 has a division by zero vulnerability in Mach-O parser's rebasebuffer function. This allow attackers to create malicious inputs that can cause denial of service.
Radare2 has a use-after-free vulnerability in pyc parser's getnoneobject function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.
A heap buffer overflow vulnerability in the rasmswfdisass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary code or carry out denial of service (DOS) attacks.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the printinsn32 function of libr/arch/p/nds32/nds32-dis.h.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the printinsn32fpu function of libr/arch/p/nds32/nds32-dis.h.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in storeversioninfognuverdef() in libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF version on 32bit systems.
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in storeversioninfognuverneed() in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems.
In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange() in libr/bin/bin.c when doing a string search.
There is a use after free in radare2 2.6.0 in ranalbbfree() in libr/anal/bb.c via a crafted Java binary file.
There is a heap out of bounds read in radare2 2.6.0 in javaswitchop() in libr/anal/p/analjava.c via a crafted Java binary file.
The grubmemmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (stack-based buffer underflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a buffer underflow in fs/ext2.c in GNU GRUB 2.02.
The grubmemmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a read overflow in the grubdiskreadsmallreal function in kern/disk.c in GNU GRUB 2.02.
The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call.
The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (rreadle16 invalid write and application crash) or possibly have unspecified other impact via a crafted ELF file.
In radare2 before 3.9.0, a command injection vulnerability exists in binsymbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
The wasmdis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.
The grubext2readblock function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array.
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
A heap buffer overflow in vaxopfunction in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in rsleb128 function in radare2 5.4.2 and 5.4.0.
A use after free in rreggetnameidx function in radare2 5.4.2 and 5.4.0.
A null pointer deference in coreanalfcn function in radare2 5.4.2 and 5.4.0.
A use after free in rregsetvalue function in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in rreadle32 function in radare25.4.2 and 5.4.0.
radare2 5.8.9 has an out-of-bounds read in rbinobjectsetitems in libr/bin/bobj.c, causing a crash in rreadle32 in libr/include/rendian.h.
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PNXNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PNXNUM count but several consumers still iterated with the original ephnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with ephnum = 0xffff and a much smaller resolved count in shdr[0].shinfo. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.