CVE-2022-1451
CVE-2022-1451 · Out-of-bounds Read in r_bin_java_constant_value_attr_new function in radareorg/radare2
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
CVSS 7.1 · High · EPSS 0.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
radareorg/radare2
- Versions
- ≥ unspecified, < 5.7.0: Affected (custom)
Update to 5.7.0
radare2 Ubuntu:16.04:LTS
- Versions
- 0.9.6-3.1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
radare2 Ubuntu:Pro:18.04:LTS
- Versions
- 1.6.0+dfsg-1
- 2.0.0+dfsg-1
- 2.1.0+dfsg-1
- 2.3.0+dfsg-1
- 2.3.0+dfsg-2
- 2.3.0+dfsg-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
radare2 Ubuntu:Pro:20.04:LTS
- Versions
- 3.2.1+dfsg-5build1
- 4.0.0+dfsg-1
- 4.2.1+dfsg-1
- 4.2.1+dfsg-2
- 4.2.1+dfsg-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
radare2 Ubuntu:Pro:24.04:LTS
- Versions
- 5.5.0+dfsg-1ubuntu1
- 5.5.0+dfsg-1.1ubuntu2
- 5.5.0+dfsg-1.1ubuntu3
- 5.5.0+dfsg-1.1ubuntu3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
radare2 Ubuntu:25.10
- Versions
- 5.9.8+dfsg-2
- 5.9.8+dfsg-2ubuntu0.25.10.1
- 5.9.8+dfsg-2ubuntu0.25.10.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
radare2 Ubuntu:26.10
- Versions
- 6.0.7+ds-1
- 6.1.6+ds-2
- 6.1.6+ds-3
- 6.1.8+ds-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
radare2 Ubuntu:26.04:LTS
- Versions
- 5.9.8+dfsg-2
- 6.0.4+dfsg-1
- 6.0.7+ds-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published