Bug 2329102 (CVE-2024-11858) - CVE-2024-11858 radare2: Command Injection via Pebble Application Files in Radare2
Summary: CVE-2024-11858 radare2: Command Injection via Pebble Application Files in Rad...
Keywords:
Status: NEW
Alias: CVE-2024-11858
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2329104 2329105 2329106 2329107 2329108
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-11-27 09:42 UTC by OSIDB Bzimport
Modified: 2024-11-27 13:19 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2024-11-27 09:42:52 UTC 
The vulnerability in Radare2 affects versions up to and including 5.9.8. When processing malicious Pebble Application files, Radare2 improperly sanitizes user-controlled input, leading to command injection. This allows arbitrary shell commands to execute during file handling. The issue was confirmed in version 5.9.7 on Linux x86-64 and demonstrated with a Base64-encoded test file​
Note You need to log in before you can comment on or make changes to this bug.