Updated radare2 packages fix security vulnerability

2020-08-1820:41:27

Gentoo Foundation

advisories.mageia.org

radare2

vulnerability

update

security

unix

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.013

Percentile

85.8%

JSON

In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it’s required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory (CVE-2020-15121). The radare2 package has been updated to version 4.5.0, fixing these issues and other bugs. Also, the radare2-cutter package has been updated to version 1.11.0.

OSVersionArchitecturePackageVersionFilename
Mageia7noarchradare2< 4.5.0-1radare2-4.5.0-1.mga7
Mageia7noarchradare2-cutter< 1.11.0-1radare2-cutter-1.11.0-1.mga7