Security Update for radare2 Package - CVE-2017-6197
Summary
DLA-837-1: radare2 - security update. Affects radare2 versions < 0.9-3+deb7u1. Fixed in 0.9-3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The radare2 package is a set of command-line tools and libraries for reverse engineering and analyzing binary files. It provides various functionalities such as disassembling, debugging, and patching binaries. The vulnerability identified as CVE-2017-6197 affects radare2 version 1.2.1 and earlier.
Vulnerability Detail
CVE-2017-6197 is a NULL pointer dereference vulnerability in the r_read_* functions of radare2's libr/include/r_endian.h file. An attacker can exploit this vulnerability by providing a specially crafted binary file, leading to a denial of service (application crash) due to the NULL pointer dereference. The r_read_le32 function is specifically mentioned as a demonstration of this vulnerability.
How To Fix
Minimum fixed version
0.9-3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade radare2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The radare2 package version 1.2.1 and earlier is vulnerable to a NULL pointer dereference issue (CVE-2017-6197). To mitigate this vulnerability, users should upgrade to radare2 version 0.9-3+deb7u1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for radare2 →
FAQ
Radare2 is a set of command-line tools and libraries for reverse engineering and analyzing binary files.
CVE-2017-6197 is a vulnerability in radare2 that allows remote attackers to cause a denial of service (application crash) by exploiting a NULL pointer dereference issue.
To fix this vulnerability, you need to upgrade the radare2 package to version 0.9-3+deb7u1 or later.
No specific workaround has been mentioned for this vulnerability.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for radare2.
