Radare2
By the Year
In 2023 there have been 16 vulnerabilities in Radare2 with an average score of 8.0 out of ten. Last year Radare2 had 48 security vulnerabilities published. Right now, Radare2 is on track to have less security vulnerabilities in 2023 than it did last year. However, the average CVE base score of the vulnerabilities in 2023 is greater by 1.05.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 16 | 8.01 |
| 2022 | 48 | 6.95 |
| 2021 | 2 | 6.50 |
| 2020 | 1 | 9.60 |
| 2019 | 8 | 7.48 |
| 2018 | 31 | 5.72 |
It may take a day or so for new Radare2 vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Radare2 Security Vulnerabilities
radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c
CVE-2023-47016
7.5 - High
- November 22, 2023
radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.
Memory Corruption
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.
CVE-2023-46570
9.8 - Critical
- October 28, 2023
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.
Out-of-bounds Read
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.
CVE-2023-46569
9.8 - Critical
- October 28, 2023
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.
Out-of-bounds Read
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
CVE-2023-5686
8.8 - High
- October 20, 2023
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Memory Corruption
A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0.
CVE-2022-28073
7.5 - High
- August 22, 2023
A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0.
Dangling pointer
A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0.
CVE-2022-28072
7.5 - High
- August 22, 2023
A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0.
Memory Corruption
A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.
CVE-2022-28071
7.5 - High
- August 22, 2023
A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.
Dangling pointer
A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
CVE-2022-28070
7.5 - High
- August 22, 2023
A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
NULL Pointer Dereference
A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.
CVE-2022-28069
7.5 - High
- August 22, 2023
A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.
Memory Corruption
A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0.
CVE-2022-28068
7.5 - High
- August 22, 2023
A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0.
Memory Corruption
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
CVE-2023-4322
9.8 - Critical
- August 14, 2023
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Memory Corruption
Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function
CVE-2021-32495
9.1 - Critical
- July 07, 2023
Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.
Dangling pointer
Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function
CVE-2021-32494
7.5 - High
- July 07, 2023
Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial of service.
Divide By Zero
Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
CVE-2023-1605
7.5 - High
- March 23, 2023
Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
Resource Exhaustion
radare2 v5.8.3 was discovered to contain a segmentation fault
CVE-2023-27114
5.5 - Medium
- March 10, 2023
radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.
NULL Pointer Dereference
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.
CVE-2023-0302
7.8 - High
- January 15, 2023
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.
Injection
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
CVE-2022-4843
7.5 - High
- December 29, 2022
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
NULL Pointer Dereference
Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0.
CVE-2022-4398
7.8 - High
- December 10, 2022
Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0.
Integer Overflow or Wraparound
A double free issue was discovered in radare2 in cmd_info.c:cmd_info()
CVE-2020-27794
9.1 - Critical
- August 19, 2022
A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modification of unexpected memory locations and potentially causing a crash.
Double-free
A segmentation fault was discovered in radare2 with adf command
CVE-2020-27795
7.5 - High
- August 19, 2022
A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_fcn_data (core, input + 1) --> RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1); returns null pointer for fcn causing segmentation fault later in ensure_fcn_range (fcn).
Use of Uninitialized Resource
An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c
CVE-2020-27793
7.5 - High
- August 19, 2022
An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crash, and perform a denail of service attack.
off-by-five
Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/bfile.c
CVE-2022-34520
5.5 - Medium
- July 22, 2022
Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/bfile.c. This vulnerability allows attackers to cause a Denial of Service (DOS) via a crafted binary file.
NULL Pointer Dereference
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c
CVE-2022-34502
5.5 - Medium
- July 22, 2022
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.
Memory Corruption
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.
CVE-2022-1899
9.1 - Critical
- May 26, 2022
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.
Out-of-bounds Read
radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference
CVE-2021-44974
5.5 - Medium
- May 25, 2022
radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.
NULL Pointer Dereference
radareorg radare2 5.5.2 is vulnerable to Buffer Overflow
CVE-2021-44975
5.5 - Medium
- May 24, 2022
radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser.
Buffer Overflow
Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.
CVE-2022-1809
7.8 - High
- May 21, 2022
Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.
Access of Uninitialized Pointer
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0
CVE-2022-1714
7.1 - High
- May 13, 2022
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Out-of-bounds Read
Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0
CVE-2022-1649
5.5 - Medium
- May 10, 2022
Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).
NULL Pointer Dereference
Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0
CVE-2022-1452
7.1 - High
- April 24, 2022
Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
Out-of-bounds Read
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0
CVE-2022-1451
7.1 - High
- April 24, 2022
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
Out-of-bounds Read
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0
CVE-2022-1444
5.5 - Medium
- April 23, 2022
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.
Dangling pointer
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0
CVE-2022-1437
7.1 - High
- April 22, 2022
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Memory Corruption
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1383
6.1 - Medium
- April 18, 2022
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Memory Corruption
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1382
5.5 - Medium
- April 18, 2022
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system.
NULL Pointer Dereference
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1297
9.1 - Critical
- April 11, 2022
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
Out-of-bounds Read
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1296
9.1 - Critical
- April 11, 2022
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
Out-of-bounds Read
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1284
5.5 - Medium
- April 08, 2022
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Dangling pointer
NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1283
5.5 - Medium
- April 08, 2022
NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).
NULL Pointer Dereference
Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6
CVE-2022-1240
7.8 - High
- April 06, 2022
Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Memory Corruption
Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1238
7.8 - High
- April 06, 2022
Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Memory Corruption
Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1237
7.8 - High
- April 06, 2022
Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
out-of-bounds array index
heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1244
5.5 - Medium
- April 05, 2022
heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Heap-based Buffer Overflow
Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8
CVE-2022-1207
6.6 - Medium
- April 01, 2022
Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.
Out-of-bounds Read
Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.
CVE-2022-1052
5.5 - Medium
- March 24, 2022
Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.
Memory Corruption
Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
CVE-2022-1061
7.5 - High
- March 24, 2022
Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
Memory Corruption
Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.
CVE-2022-1031
7.8 - High
- March 22, 2022
Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.
Dangling pointer
Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.
CVE-2022-0849
5.5 - Medium
- March 05, 2022
Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.
Dangling pointer
A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2
CVE-2021-4021
7.5 - High
- February 24, 2022
A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS.
Excessive Iteration
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
CVE-2022-0695
5.5 - Medium
- February 24, 2022
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
Resource Exhaustion
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
CVE-2022-0476
5.5 - Medium
- February 23, 2022
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
Resource Exhaustion
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
CVE-2022-0713
7.1 - High
- February 22, 2022
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Memory Corruption
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
CVE-2022-0712
5.5 - Medium
- February 22, 2022
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
NULL Pointer Dereference
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
CVE-2022-0676
7.8 - High
- February 22, 2022
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Memory Corruption
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
CVE-2022-0559
9.8 - Critical
- February 16, 2022
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Dangling pointer
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
CVE-2022-0523
7.8 - High
- February 08, 2022
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Dangling pointer
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
CVE-2022-0522
7.1 - High
- February 08, 2022
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
Buffer Overflow
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
CVE-2022-0521
7.1 - High
- February 08, 2022
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
Buffer Overflow
Use After Free in NPM radare2.js prior to 5.6.2.
CVE-2022-0520
7.8 - High
- February 08, 2022
Use After Free in NPM radare2.js prior to 5.6.2.
Dangling pointer
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
CVE-2022-0519
7.1 - High
- February 08, 2022
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
Buffer Overflow
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
CVE-2022-0518
7.1 - High
- February 08, 2022
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
Memory Corruption
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
CVE-2022-0139
9.8 - Critical
- February 08, 2022
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
Dangling pointer
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
CVE-2022-0419
5.5 - Medium
- February 01, 2022
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
NULL Pointer Dereference
radare2 is vulnerable to Out-of-bounds Read
CVE-2022-0173
5.5 - Medium
- January 11, 2022
radare2 is vulnerable to Out-of-bounds Read
Out-of-bounds Read
A vulnerability was found in Radare2 in version 5.3.1
CVE-2021-3673
7.5 - High
- August 02, 2021
A vulnerability was found in Radare2 in version 5.3.1. Improper input validation when reading a crafted LE binary can lead to resource exhaustion and DoS.
Unchecked Return Value
In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse
CVE-2021-32613
5.5 - Medium
- May 14, 2021
In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
Double-free
In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection
CVE-2020-15121
9.6 - Critical
- July 20, 2020
In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.
Shell injection
radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c
CVE-2019-19647
7.8 - High
- December 09, 2019
radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.
NULL Pointer Dereference
In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c
CVE-2019-19590
7.8 - High
- December 05, 2019
In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted input.
Integer Overflow or Wraparound
In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c
CVE-2019-16718
7.8 - High
- September 23, 2019
In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
Shell injection
In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c
CVE-2019-14745
7.8 - High
- August 07, 2019
In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.
Command Injection
In radare2 through 3.5.1
CVE-2019-12865
5.5 - Medium
- June 17, 2019
In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.
Double-free
radare2 through 3.5.1 mishandles the RParse API, which
CVE-2019-12829
7.5 - High
- June 15, 2019
radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c.
Buffer Overflow
In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context
CVE-2019-12802
7.8 - High
- June 13, 2019
In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar; invalid free in rcc_pusharg).
Dangling pointer
In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c
CVE-2019-12790
7.8 - High
- June 10, 2019
In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c.
Out-of-bounds Read
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may
CVE-2018-20455
5.5 - Medium
- December 25, 2018
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.
Memory Corruption
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may
CVE-2018-20456
5.5 - Medium
- December 25, 2018
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file, a related issue to CVE-2018-20455.
Out-of-bounds Read
In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c
CVE-2018-20457
5.5 - Medium
- December 25, 2018
In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-service (application crash via an r_num_calc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20459.
Out-of-bounds Read
In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may
CVE-2018-20458
5.5 - Medium
- December 25, 2018
In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting an input file.
Out-of-bounds Read
In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c
CVE-2018-20459
5.5 - Medium
- December 25, 2018
In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.
Out-of-bounds Read
In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c
CVE-2018-20460
5.5 - Medium
- December 25, 2018
In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.
Memory Corruption
In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c
CVE-2018-20461
5.5 - Medium
- December 25, 2018
In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.
Out-of-bounds Read
getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0
CVE-2018-19842
5.5 - Medium
- December 04, 2018
getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
Out-of-bounds Read
opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0
CVE-2018-19843
5.5 - Medium
- December 04, 2018
opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
Out-of-bounds Read
In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c
CVE-2018-15834
5.5 - Medium
- September 12, 2018
In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file.
Memory Corruption
The sdb_set_internal function in sdb.c in radare2 2.7.0
CVE-2018-14015
5.5 - Medium
- July 12, 2018
The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c.
Buffer Overflow
The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0
CVE-2018-14016
5.5 - Medium
- July 12, 2018
The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Mini Crash Dump file.
Out-of-bounds Read
The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0
CVE-2018-14017
5.5 - Medium
- July 12, 2018
The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new.
Out-of-bounds Read
There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c
CVE-2018-12320
7.8 - High
- June 13, 2018
There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.
Dangling pointer
There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c
CVE-2018-12321
7.8 - High
- June 13, 2018
There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.
Out-of-bounds Read
There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c
CVE-2018-12322
5.5 - Medium
- June 13, 2018
There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.
Out-of-bounds Read
The _inst__lds() function in radare2 2.5.0
CVE-2018-11375
5.5 - Medium
- May 22, 2018
The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Out-of-bounds Read
The r_read_le32() function in radare2 2.5.0
CVE-2018-11376
5.5 - Medium
- May 22, 2018
The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.
Out-of-bounds Read
The avr_op_analyze() function in radare2 2.5.0
CVE-2018-11377
5.5 - Medium
- May 22, 2018
The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Out-of-bounds Read
The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact
CVE-2018-11378
7.8 - High
- May 22, 2018
The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.
Buffer Overflow
The get_debug_info() function in radare2 2.5.0
CVE-2018-11379
5.5 - Medium
- May 22, 2018
The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file.
Out-of-bounds Read
The parse_import_ptr() function in radare2 2.5.0
CVE-2018-11380
5.5 - Medium
- May 22, 2018
The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted Mach-O file.
Out-of-bounds Read
The string_scan_range() function in radare2 2.5.0
CVE-2018-11381
5.5 - Medium
- May 22, 2018
The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Out-of-bounds Read
The _inst__sts() function in radare2 2.5.0
CVE-2018-11382
5.5 - Medium
- May 22, 2018
The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Out-of-bounds Read
The r_strbuf_fini() function in radare2 2.5.0
CVE-2018-11383
5.5 - Medium
- May 22, 2018
The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c.
Use of Uninitialized Resource
