Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Mageia 7, 8 MGASA-2021-0160 Critical: Radare2 Segmentation Fault Issues

mageia
Calendar Grey March 30, 2021
Dist Mageia Esm H88
Recent updates to radare2 packages in Mageia address several security flaws, including issues stemming from corrupted data that may lead to system crashes.
radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section (...

Summary

radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section (CVE-2020-16269).
radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY (CVE-2020-17487).
Also, the radare2-cutter package has been switched to a new upstream that uses a different versioning scheme.

References

- https://bugs.mageia.org/show_bug.cgi?id=28476

- https://github.com/rizinorg/cutter/releases/tag/v1.12.0

- https://github.com/radareorg/iaito/releases/tag/0.1.0

- https://github.com/radareorg/iaito/releases/tag/0.1.1

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/45SGGCWFIIV7N2X2QZRREHOW7ODT3IH7/

- https://www.cve.org/CVERecord?id=CVE-2020-16269

- https://www.cve.org/CVERecord?id=CVE-2020-17487

Topics%20covered

Topics Covered

security advisory critical issue update critical segmentation fault Mageia radare2 DWARF parsing PE file issues malformed information

Resolution

SRPMS

- 8/core/radare2-cutter-0.1.1-1.mga8

- 7/core/radare2-cutter-0.1.1-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 30 Mar 2021
URL: https://advisories.mageia.org/MGASA-2021-0160.html
Type: security
CVE: CVE-2020-16269, CVE-2020-17487

Topics%20covered

Topics Covered

security advisory critical issue update critical segmentation fault Mageia radare2 DWARF parsing PE file issues malformed information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here