MGASA-2020-0100: radare2 Mageia

Vulnerability summary

MGASA-2020-0100 is a vulnerability in radare2 Mageia with no CVSS score yet.

Timeline

1. 24-02-2020
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Updated radare2 packages fix security vulnerabilities Updated radare2 packages fix security vulnerabilities: A vulnerability was found in radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted input (CVE-2019-19590). radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input (CVE-2019-19647). The radare2 package has been updated to version 4.2.1, fixing these issues and other bugs. Also, the radare2-cutter package has been updated to version 1.10.1.

No weakness data has been published for this record.