PT-2021-11005 · Unknown · Radare2-Extras

Jjy-Sec · Published 2021-07-14 · Updated 2022-10-26 · CVE-2020-24133

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Radare2-extras versions before commit e74a93c

Description: A heap buffer overflow vulnerability in the r asm swf disass function allows attackers to execute arbitrary code or carry out denial of service (DOS) attacks.

Recommendations: For versions before commit e74a93c, update to a version that includes the fix for the heap buffer overflow vulnerability in the r asm swf disass function. As a temporary workaround, consider disabling the r asm swf disass function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-24133

Affected Products

Radare2-Extras

References · 9

• https://github.com/radareorg/radare2-extras/pull/255/commits/4a8b24475549ff10bdf6d07fd4b5f6c1cc6246ea · Patch
• https://github.com/radareorg/radare2-extras/pull/255/commits/9f6a221433964d9b14f3ed78bc9fb059395b893b · Patch
• https://github.com/radareorg/radare2-extras/pull/255 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-24133 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24133 · Vendor Advisory
• https://t.me/cvenotify/18341 · Telegram Post
• https://t.me/cvenotify/17634 · Telegram Post
• https://cwe.mitre.org/data/definitions/122.html · Note
• https://t.me/cibsecurity/26172 · Telegram Post