Radare2 Security Vulnerabilities - February 2022

CVE-2021-4021

A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS.

CVE-2022-0139

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.

CVE-2022-0419

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.

CVE-2022-0476

Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.

CVE-2022-0518

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.

CVE-2022-0519

Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.

CVE-2022-0520

Use After Free in NPM radare2.js prior to 5.6.2.

CVE-2022-0521

Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.

CVE-2022-0522

Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.

CVE-2022-0523

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.

CVE-2022-0559

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.

CVE-2022-0676

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.

CVE-2022-0695

Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.

CVE-2022-0712

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.

CVE-2022-0713

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.