CVE-2017-16357

High

Published: 01/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In version 2.0.1 of radare, a memory corruption vulnerability exists in the functions store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in the file elf.c. This issue is due to improper sh_size validation during memory allocation.

Risk Assessment

This vulnerability may lead to unauthorized memory access, potentially resulting in application crashes or the execution of malicious code. Organizations should be aware of the potential threats associated with this flaw.

Recommendation

It is recommended to update to a newer version of radare where the issue has been fixed. Additionally, conducting a code audit to identify similar errors is advisable.

Other vulnerabilities in radare 2.0.1

CVE-2017-16358High
In radare version 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when performing a string search.

Original NVD description (English source)

In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS