Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0024
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0024)
Summary:	The remote host is missing an update for the 'radare2, radare2-cutter' package(s) announced via the MGASA-2020-0024 advisory.
Description:	Summary: The remote host is missing an update for the 'radare2, radare2-cutter' package(s) announced via the MGASA-2020-0024 advisory. Vulnerability Insight: Updated radare2 packages fix security vulnerabilities: In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c (CVE-2019-12790). In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar, invalid free in rcc_pusharg) (CVE-2019-12802). In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command (CVE-2019-12865). By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables (CVE-2019-14745). The radare2 package has been updated to version 3.9.0, fixing these issues and other bugs. Also, the radare2-cutter package has been updated to version 1.9.0. Affected Software/OS: 'radare2, radare2-cutter' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-12790 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IEXZWAMVKGZKHALV4IVWQS2ORJKRH57U/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SX4TLTE75VYUGSPYEKMYFPUZMRDIR7O2/ https://github.com/radare/radare2/issues/14211 Common Vulnerability Exposure (CVE) ID: CVE-2019-12802 https://github.com/radare/radare2/issues/14296 Common Vulnerability Exposure (CVE) ID: CVE-2019-12865 https://github.com/radare/radare2/issues/14334 Common Vulnerability Exposure (CVE) ID: CVE-2019-14745 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETWG4VKHWL5F74L3QBBKSCOXHSRNSRRT/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MGA2PVBFA6VPWWLMBGWVBESHAJBQ7OXJ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQO7V37RGQEKZDLY2JYKDZTLNN2YUBC5/ https://bananamafia.dev/post/r2-pwndebian/ https://github.com/radare/radare2/pull/14690 https://github.com/radare/radare2/releases/tag/3.7.0
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.