radare2: CVE-2019-19590

Debian Bug report logs - #947791
radare2: CVE-2019-19590

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: radare2: CVE-2019-19590

Date: Mon, 30 Dec 2019 21:05:18 +0100

Source: radare2
Version: 3.2.1+dfsg-5
Severity: important
Tags: security upstream
Forwarded: https://github.com/radareorg/radare2/issues/15543

Hi,

The following vulnerability was published for radare2.

CVE-2019-19590[0]:
| In radare2 through 4.0, there is an integer overflow for the variable
| new_token_size in the function r_asm_massemble at libr/asm/asm.c. This
| integer overflow will result in a Use-After-Free for the buffer
| tokens, which can be filled with arbitrary malicious data after the
| free. This allows remote attackers to cause a denial of service
| (application crash) or possibly execute arbitrary code via crafted
| input.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-19590
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19590
[1] https://github.com/radareorg/radare2/issues/15543

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.