radare2 vulnerabilities

Version 6.1.5 of radare2 contains a use-after-free vulnerability in the gdbr_pids_list() function, which can be exploited by remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses.

radare2 version 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function. This allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response.

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in elf.c, which can be triggered by crafted ELF files when parsing the ELF version on 32-bit systems.

In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in elf.c, which can be exploited via crafted ELF files on 32-bit systems.

The store_versioninfo_gnu_verdef function in radare2 2.0.0 allows remote attackers to cause a denial of service via a crafted ELF file, leading to an invalid write in r_read_le16 and application crash.

The wasm_dis function in radare2 version 2.0.0 allows remote attackers to cause denial of service through stack-based buffer over-read, leading to application crash. The attack can be executed using a crafted WASM file that triggers an incorrect r_hex_bin2str call.

The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted binary file.

The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service via a crafted binary file, potentially leading to application crashes due to a buffer underflow.

The dalvik_disassemble function in radare2 version 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.

The relocs function in libr/bin/p/bin_bflt.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.

A vulnerability was found in radare2 up to version 6.1.6 in the Memory64ListStream parser within mdmp.c. A local attacker can trigger a stack-based buffer overflow by manipulating input data. The exploit is publicly available.

A use-after-free vulnerability has been detected in radare2 up to version 6.1.6 in the function r_core_bin_load within libr/core/cfile.c. The attack requires local access and the exploit has been publicly disclosed.

A vulnerability has been found in radareorg radare2 up to version 6.1.6, involving an integer overflow in the cmd_print function within the pb Print Command Handler component. The attack requires local access and a public exploit is available.

A security flaw in radare2 up to version 6.1.6 affects the r_str_word_get0set function in libr/util/str.c, causing an integer overflow. The attack requires local access and a public exploit is available.

A security vulnerability has been detected in radareorg radare2 up to version 6.1.6, involving an integer overflow in the r_str_ndup/r_str_append functions in libr/util/str.c. The attack requires local access and the exploit has been publicly disclosed.

A use-after-free vulnerability has been found in radare2 up to version 6.1.6 in the function r_core_seek_arch_bits within libr/core/disasm.c, specifically in the regprofile handler component.

A heap-based buffer overflow vulnerability was discovered in radare2 up to version 6.1.6 in the r_bin_java_inner_classes_attr_calc_size function of shlr/java/class.c, part of the RBinJava Line Number Table Parser. Local manipulation triggers the overflow, and a public exploit exists.

A vulnerability was found in radare2 up to version 6.1.6 in the cmd_anal_opcode function of libr/core/cmd_anal.inc.c within the hexpairs Parser component. Data manipulation leads to an integer overflow. The attack requires local access and the exploit is publicly available.

A vulnerability in radare2 up to version 6.1.6 was found in the core_anal_bytes function of libr/core/cmd_anal.inc, causing an integer overflow. The attack requires local access and has been publicly disclosed.

A command injection vulnerability was found in radare2 prior to commit bc5a890 in the afsv/afsvj command path. Malicious ELF binaries can embed r2 command sequences as DWARF DW_TAG_formal_parameter names, which execute when the binary is analyzed with aaa and afsvj, allowing arbitrary shell command execution through unsanitized parameter interpolation in the pfq command string.