p PatchFirst

CVE-2019-14745

CVE-2019-14745

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.

CVSS 7.8 · High · EPSS 4.5%

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • radare2 Ubuntu:16.04:LTS

    Versions
    • 0.9.6-3.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.6.0+dfsg-1
    • 2.0.0+dfsg-1
    • 2.1.0+dfsg-1
    • 2.3.0+dfsg-1
    • 2.3.0+dfsg-2
    • 2.3.0+dfsg-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:Pro:20.04:LTS

    Versions
    • 3.2.1+dfsg-5build1
    • 4.0.0+dfsg-1
    • 4.2.1+dfsg-1
    • 4.2.1+dfsg-2
    • 4.2.1+dfsg-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:Pro:24.04:LTS

    Versions
    • 5.5.0+dfsg-1ubuntu1
    • 5.5.0+dfsg-1.1ubuntu2
    • 5.5.0+dfsg-1.1ubuntu3
    • 5.5.0+dfsg-1.1ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:25.10

    Versions
    • 5.9.8+dfsg-2
    • 5.9.8+dfsg-2ubuntu0.25.10.1
    • 5.9.8+dfsg-2ubuntu0.25.10.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:26.10

    Versions
    • 6.0.7+ds-1
    • 6.1.6+ds-2
    • 6.1.6+ds-3
    • 6.1.8+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:26.04:LTS

    Versions
    • 5.9.8+dfsg-2
    • 6.0.4+dfsg-1
    • 6.0.7+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →