Heap-based Buffer Overflow in radareorg/radare2

radareorg radare2 Memory64ListStream mdmp.c stack-based overflow

radareorg radare2 cfile.c r_core_bin_load use after free

radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow

radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free

radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow

radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow

radare2 < 6.1.4 Project Notes Path Traversal via Symlink

radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

radare2 Command Injection via DWARF Parameter Names

radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()

Radare2: command injection via pebble application files in radare2

Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2

Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0

Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0

Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8

Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8

Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2

Use After Free in NPM radare2.js prior to 5.6.2

radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write

In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c

In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c

In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c

In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context

In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c

There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file

There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file

The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file

In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search

In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an…

In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c via crafted ELF…

In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c via crafted ELF…

The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (r_read_le16 invalid write and…

The wasm_dis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) or…

The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or…

The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (stack-based buffer underflow and application crash) or…

The dalvik_disassemble function in libr/asm/p/asm_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application…

The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly…

The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly…

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h

A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0

A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0

A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0

A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0

A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0

A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0