CVE-2022-36040 - Rizin Out-of-bounds Write vulnerability in pyc/marshal.c

Back Back to CVE browser

HIGH

Rizin Out-of-bounds Write vulnerability in pyc/marshal.c

Published Sep 6, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.39%

Description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from PYC(python) files. A user opening a malicious PYC file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 68948017423a12786704e54227b8b2f918c2fd27 contains a patch.

Affected products

Vendor Rizinorg Product Rizin Default
n/a
- Version
  <= 0.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rizinorg

Rizin

n/a

Version	Status	Constraints
<= 0.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38813
Advisory
https://github.com/rizinorg/rizin/commit/68948017423a12786704e54227b8b2f918c2fd27
PatchThird Party Advisory
https://github.com/rizinorg/rizin/issues/2963
Third Party Advisory
https://github.com/rizinorg/rizin/security/advisories/GHSA-h897-rhm9-rpmw
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
vendor-advisory
https://security.gentoo.org/glsa/202209-06
vendor-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38813		Advisory
https://github.com/rizinorg/rizin/commit/68948017423a12786704e54227b8b2f918c2fd27		PatchThird Party Advisory
https://github.com/rizinorg/rizin/issues/2963		Third Party Advisory
https://github.com/rizinorg/rizin/security/advisories/GHSA-h897-rhm9-rpmw		Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/		vendor-advisory
https://security.gentoo.org/glsa/202209-06		vendor-advisoryThird Party Advisory