ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2020.0024
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2020-0024)
Resumen:	The remote host is missing an update for the 'radare2, radare2-cutter' package(s) announced via the MGASA-2020-0024 advisory.
Descripción:	Summary: The remote host is missing an update for the 'radare2, radare2-cutter' package(s) announced via the MGASA-2020-0024 advisory. Vulnerability Insight: Updated radare2 packages fix security vulnerabilities: In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c (CVE-2019-12790). In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar, invalid free in rcc_pusharg) (CVE-2019-12802). In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command (CVE-2019-12865). By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables (CVE-2019-14745). The radare2 package has been updated to version 3.9.0, fixing these issues and other bugs. Also, the radare2-cutter package has been updated to version 1.9.0. Affected Software/OS: 'radare2, radare2-cutter' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2019-12790 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IEXZWAMVKGZKHALV4IVWQS2ORJKRH57U/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SX4TLTE75VYUGSPYEKMYFPUZMRDIR7O2/ https://github.com/radare/radare2/issues/14211 Common Vulnerability Exposure (CVE) ID: CVE-2019-12802 https://github.com/radare/radare2/issues/14296 Common Vulnerability Exposure (CVE) ID: CVE-2019-12865 https://github.com/radare/radare2/issues/14334 Common Vulnerability Exposure (CVE) ID: CVE-2019-14745 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETWG4VKHWL5F74L3QBBKSCOXHSRNSRRT/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MGA2PVBFA6VPWWLMBGWVBESHAJBQ7OXJ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQO7V37RGQEKZDLY2JYKDZTLNN2YUBC5/ https://bananamafia.dev/post/r2-pwndebian/ https://github.com/radare/radare2/pull/14690 https://github.com/radare/radare2/releases/tag/3.7.0
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.