Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

radare2: CVE-2023-46570 CVE-2023-46569

Related Vulnerabilities: CVE-2023-46570   CVE-2023-46569  

Source

Debian Bug report logs - #1054908
radare2: CVE-2023-46570 CVE-2023-46569

Package: radare2; Maintainer for radare2 is Debian Security Tools <team+pkg-security@tracker.debian.org>; Source for radare2 is src:radare2 (PTS, buildd, popcon).

Reported by: Moritz Mühlenhoff <jmm@inutil.org>

Date: Sat, 28 Oct 2023 14:27:01 UTC

Severity: important

Tags: security, upstream

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, unknown-package@qa.debian.org:
Bug#1054908; Package src:important. (Sat, 28 Oct 2023 14:27:03 GMT) (full text, mbox, link).

Acknowledgement sent to Moritz Mühlenhoff <jmm@inutil.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, unknown-package@qa.debian.org.

Your message specified a Severity: in the pseudo-header, but the severity value radare2 was not recognised. The default severity normal is being used instead. The recognised values are: critical, grave, serious, important, normal, minor, wishlist, fixed.

(Sat, 28 Oct 2023 14:27:03 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>
To: submit@bugs.debian.org
Subject: important: CVE-2023-46570 CVE-2023-46569
Date: Sat, 28 Oct 2023 16:24:51 +0200
Source: important
X-Debbugs-CC: team@security.debian.org
Severity: radare2
Tags: security

Hi,

The following vulnerabilities were published for important.

CVE-2023-46570[0]:
| An out-of-bounds read in radare2 v.5.8.9 and before exists in the
| print_insn32 function of libr/arch/p/nds32/nds32-dis.h.

https://github.com/radareorg/radare2/issues/22333
Fixed by: https://github.com/radareorg/radare2/commit/3e406459f163eba7672b3421c8a84b2c0e4ac0f8

CVE-2023-46569[1]:
| An out-of-bounds read in radare2 v.5.8.9 and before exists in the
| print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.

https://github.com/radareorg/radare2/issues/22334
Fixed by: https://github.com/radareorg/radare2/commit/2e2f2a9b1800d09be09461e7536ac03a301f97f2

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-46570
    https://www.cve.org/CVERecord?id=CVE-2023-46570
[1] https://security-tracker.debian.org/tracker/CVE-2023-46569
    https://www.cve.org/CVERecord?id=CVE-2023-46569

Please adjust the affected versions in the BTS as needed.

Bug reassigned from package 'src:important' to 'radare2'. Request was from Moritz Muehlenhoff <jmm@inutil.org> to control@bugs.debian.org. (Sat, 28 Oct 2023 14:39:02 GMT) (full text, mbox, link).

Severity set to 'important' from 'normal' Request was from Moritz Muehlenhoff <jmm@inutil.org> to control@bugs.debian.org. (Sat, 28 Oct 2023 14:39:04 GMT) (full text, mbox, link).

Changed Bug title to 'radare2: CVE-2023-46570 CVE-2023-46569' from 'important: CVE-2023-46570 CVE-2023-46569'. Request was from Moritz Muehlenhoff <jmm@inutil.org> to control@bugs.debian.org. (Sat, 28 Oct 2023 14:39:06 GMT) (full text, mbox, link).

Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sat, 28 Oct 2023 15:24:02 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Oct 28 17:55:09 2023; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started