ArchLinux: 202106-40: radare2: denial of service
Summary
In radare2 through 5.3.0 there is a double free vulnerability in the pyc parser via a crafted file which can lead to denial of service.
Resolution
Upgrade to 5.3.1-1.
# pacman -Syu "radare2>=5.3.1-1"
The problem has been fixed upstream in version 5.3.1.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1959939 https://github.com/radareorg/radare2/issues/18679 https://github.com/radareorg/radare2/commit/049de62730f4954ef9a642f2eeebbca30a8eccdc https://security.archlinux.org/CVE-2021-32613
Workaround
None.