CVE-2019-19647 - radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write

Back Back to CVE browser

HIGH

radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write

Published Dec 9, 2019

7.8

HIGH

CVSS 3.1

EPSS 1.58%

Description

radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9257
Advisory
https://github.com/radareorg/radare2/issues/15545
x_refsource_MISCExploitThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRQXCOVFWZIIMAZIAAFAVQGZOS7LGHXP/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQTOWEDFXDTGTD6D4NHRB4FUURQSTTEN/
vendor-advisoryx_refsource_FEDORA

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9257		Advisory
https://github.com/radareorg/radare2/issues/15545		x_refsource_MISCExploitThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRQXCOVFWZIIMAZIAAFAVQGZOS7LGHXP/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQTOWEDFXDTGTD6D4NHRB4FUURQSTTEN/		vendor-advisoryx_refsource_FEDORA

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 9, 2019

Updated Aug 5, 2024

Reserved Dec 9, 2019

Link CVE-2019-19647

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-19647

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Dec 9, 2019

Updated Aug 5, 2024

Link EUVD-2019-9257

GitHub

No data